1
1 UNITED STATES FEDERAL TRADE COMMISSION 2 Washington, D.C. 3 4 5 6 RADIO FREQUENCY IDENTIFICATION: 7 Applications and Implications for Consumers 8 An FTC Workshop 9 10 11 12 June 21, 2004 13 8:30 a.m. to 5:30 p.m. 14 15 16 Federal Trade Commission Conference Center 17 601 New Jersey Avenue, N.W. 18 Washington D.C. 19 20 21 22 23 24
25 Reported by: Karen Guy and Susanne Bergling, RMR For The Record, Inc. Waldorf, Maryland (301) 870-8025 2
1 C O N T E N T S 2 3 Opening Remarks 4 J. Howard Beales, III...... 5 5 6 7 Panel 1: The ABCs of RFID 8 Julie Brof, Moderator...... 9 9 10 11 Panel 2: Current and Anticipated Uses for RF Technology 12 Lyle Ginsburg, Co-moderator 13 Charles Harwood, Co-moderator...... 42 14 15 16 Remarks 17 Commissioner Mozelle W. Thompson...... 123 18 19 20 Panel 3: Implications of RFID Use for Consumers 21 Ellen Finn, Co-moderator 22 Frederick C. Livingston, Co-moderator.... 129 23 24
25 For The Record, Inc. Waldorf, Maryland (301) 870-8025 3
1 Panel 4: Looking Ahead: Competing Visions of the 2 Future of RFID 3 Julie Brof, Moderator...... 215 4 5 6 Panel 5: Meeting the Challenge: Best Practices and 7 Principles: 8 Elliot Maxwell, Co-moderator 9 Tracy Thorleifson, Co-moderator...... 254 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24
25 For The Record, Inc. Waldorf, Maryland (301) 870-8025 4
1 P R O C E E D I N G S 2 - - - - - 3 MS. BROF: Hello. I'm Julie Brof with the 4 Federal Trade Commission's Northwest Regional Office. 5 I've spoken to a number of you, and welcome to the FTC. 6 Before we start today's proceedings, I have some 7 important logistical and safety information to share 8 with you. We're very low-tech here, so if you leave the 9 building at any time, you'll be rescreened through 10 security to re-enter, so make sure you bring some form 11 of identification with you when you leave the building, 12 and keep your IDs or your name tags on when you're in 13 the building. 14 Please turn off all cell phones or pagers or set 15 them to vibrate during the workshop, and fire exits are 16 through the main doors at the front of the building or 17 on New Jersey Avenue and through the pantry area, which 18 is right behind here through a corridor to G Street, and 19 in the event of an emergency or drill, please proceed to 20 the Union Labor Life Building directly across 21 Massachusetts Avenue, but don't follow me, I'm not 22 sure -- oh, that way (indicating). 23 The bathrooms, very important, are located 24 across the lobby, and there are signs right outside the
25 conference area to direct you. Also very important, if For The Record, Inc. Waldorf, Maryland (301) 870-8025 5
1 you would like to get some coffee during one of the 2 breaks, we have the Sunspot Cafe in the building and 3 Cafe Phillips right on F Street across the street, and 4 there is information in your packets on where to go for 5 lunch around here as well. 6 So, thank you all for coming, and without 7 further adieu, I would like to introduce Howard Beales, 8 the Director of the Federal Trade Commission's Bureau of 9 Consumer Protection, our fearless leader and the reason 10 we're all here today. 11 OPENING REMARKS 12 MR. BEALES: Thank you. Thank you, Julie. I 13 would like to welcome you all to our workshop on radio 14 frequency identification technology. 15 RFID has been described as the next big thing, 16 but it's definitely not a new concept. It was 17 originally developed during World War II and used as 18 friend or foe technology. Fifty years later, the 19 technology is still evolving, and RFID is still asking 20 the fundamental question, "Who goes there?" 21 Another important question is, why are we here 22 today? Why is the FTC interested in RFID? Well, today 23 RFID is not just a business issue, but it's become an 24 important consumer issue as well. It promises to
25 reform, if not revolutionize, many corners of the For The Record, Inc. Waldorf, Maryland (301) 870-8025 6
1 marketplace. 2 In the supply chain, it's transforming the 3 track-and-trace process. At the same time, it's making 4 transportation, health care and the food supply more 5 efficient and safer. 6 We've got a great day planned. We're going to 7 learn about the range of RFID applications from both 8 developers and users in both the private and public 9 sectors. We'll also be hearing from folks who are 10 looking at the impact of these applications on 11 consumers' lives, the benefits, like efficiency, product 12 safety and access to information, and the potential 13 drawbacks that may compromise the privacy and security 14 of consumer data. 15 We'll be hearing from some experts with views on 16 what the future will bring, and then we'll close the day 17 with some suggestions on how to address concerns about 18 RFID use. 19 This workshop is the latest in a series that was 20 designed to help us educate ourselves and the public on 21 emerging consumer protection issues. I want to thank 22 our panelists who have traveled from near and far to 23 help us do that. 24 I'd also like to thank those of you in the
25 audience and ask that you participate. Your questions For The Record, Inc. Waldorf, Maryland (301) 870-8025 7
1 and comments can help inform the discussion. 2 I also want to thank VeriSign, RSA Labs and 3 Texas Instruments for providing examples of RFID 4 technology and applications in action. During the 5 breaks, please take a look at these exhibits that are 6 out here at gallery which we are referring to as the 7 "Petting Zoo." We have great names for our IT projects 8 here. We have a refrigerator to hold spam, we have a 9 jet plane that matches numbers telemarketers called with 10 the Do-Not-Call List, and now we have a petting zoo. 11 I'd also like to say how pleased I am to see how 12 many industry members who are here today who are taking 13 the initiative to address consumer privacy concerns and 14 incorporate these considerations into the design and 15 deployment of RFID. 16 Consumer privacy is a critical issue for the FTC 17 and across the Federal Government, which is also well 18 represented here today, and for the business community. 19 The efforts to address consumer privacy take a variety 20 of forms, and that's as it should be. 21 The wide range of uses for RFID makes a 22 one-size-fits-all solution unlikely, but the common 23 objective should be transparency. There could not be a 24 clearer need for transparency than when a new technology
25 is deployed in new and different ways. For The Record, Inc. Waldorf, Maryland (301) 870-8025 8
1 We need to tell consumers what's going on and 2 why it makes sense, and we need to tell them in a way 3 that doesn't place on consumers the totally unreasonable 4 burden of comparing the privacy policies of the 5 40,000-plus items that inhabit a typical supermarket. 6 If we aren't transparent, fears may defeat the 7 benefits that RFID may bring to business, government and 8 consumers alike. We must not let that happen. 9 Consumers need to know about this technology, both what 10 it does and what it does not do. 11 Technology developers and users should consider 12 what information is collected from consumers and why. 13 Just because data can be collected doesn't mean it 14 should be. And once that information is collected, it 15 must be secured. 16 The FTC has certainly spent a lot of time over 17 the past few years addressing information security 18 issues, which are vital to good business practices. 19 These considerations are not unique to RFID, but this 20 kind of analysis is critical to re-assuring consumers 21 about their privacy any time a new use of technology is 22 contemplated. It's a challenge that is shared by the 23 private sector and the Government. 24 I'm wearing two hats today. As the head of the
25 FTC's Bureau of Consumer Protection, I'm looking forward For The Record, Inc. Waldorf, Maryland (301) 870-8025 9
1 to learning about RFID, but I'm also interested in 2 what's in store for me as a consumer, and we hope 3 today's workshop will provide a basis for everyone to 4 continue their efforts to advance this technology in a 5 responsible manner and inspire more. 6 Before I turn it over to Julie for the first 7 panel, let me take a moment to thank her for her hard 8 work in organizing this workshop. Julie, along with 9 Tracy Thorleifson and Chuck Harwood, all of our 10 Northwest Regional Office in Seattle, have put together 11 a great program. Again, we're very glad to see you 12 here, and take it away, Julie. 13 PANEL 1 14 MS. BROF: Thank you. Hello again. With the 15 help of our distinguished presenters to my left, this 16 panel will explain, as the title states, the ABCs of 17 RFID. Some of the questions we'll address are really 18 the basics. How does radio frequency identification 19 technology work? What kinds of systems are properly 20 defined as RFID, and what are its parameters? And how 21 does RFID differ from other technologies that serve 22 related or similar functions? 23 Before we launch into the discussion, I'd like 24 to introduce the experts sitting beside me who will be
25 the ones actually answering these questions. First For The Record, Inc. Waldorf, Maryland (301) 870-8025 10
1 we'll hear from Sue Hutchinson, who is a product manager 2 with EPCglobal U.S. EPCglobal, as most of you know, is 3 the joint venture of the Uniform Code Council and EAN 4 international. EPCglobal's mission is to establish and 5 support an internationally recognized standard for 6 realtime automatic identification of any item in the 7 supply chain of any company anywhere in the world. 8 As product manager for the EPCglobal U.S. 9 Division, Ms. Hutchinson is responsible for the Solution 10 Partner Program and for building subscriber services for 11 the many hardware and software companies joining 12 EPCglobal. Sue will give us an overview of RFID, 13 including a video showing how consumers are interacting 14 with electronic product codes. She will also discuss 15 the applications of this technology, which will provide 16 some critical context for the rest of today's 17 discussions. 18 Next we'll hear from Dr. Daniel Engels, who is 19 the Executive and Research Director of the Auto-ID Labs 20 at the Massachusetts Institute of Technology. 21 Dr. Engels was appointed to his current position in 22 October 2003 when the Auto-ID Labs was founded in order 23 to continue research related to the EPC system. 24 As a successor to the Auto-ID Center, the MIT
25 Auto-ID Labs, under Dr. Engels' leadership, continues to For The Record, Inc. Waldorf, Maryland (301) 870-8025 11
1 explore new applications of RFID technology. In his 2 presentation, Dr. Engels will provide some important 3 background on the evolution of RFID. He will also 4 explain some facets of how it functions and how it 5 differs from competing technologies. 6 Finally, we'll hear from Manuel Albers, the 7 Regional Director of Business Development for 8 Identification Products in the Americas at Philips 9 Semiconductors. Philips Semiconductor is a global 10 leader in the design and manufacture of chips used in 11 RFID tags, and they have shipped more than 1 billion 12 such chips to date. Philips' RFID-based technology is 13 used across a diverse set of applications, such as 14 supply chain management, transportation and security, 15 all applications we'll hear more in-depth about today. 16 Manuel is a native of Hamburg, Germany, and has 17 ten years of experience with smart card and RFID 18 technology. Manuel's presentation will further explore 19 how RFID is touching our lives already, which like Sue's 20 presentation is a good preview of what will be addressed 21 in greater detail as the day proceeds. 22 After we hear from our experts and discuss some 23 follow-up questions I have, we'll have time for some 24 questions from the audience, and this goes for the rest
25 of today's panels as well. Each of you has some index For The Record, Inc. Waldorf, Maryland (301) 870-8025 12
1 cards in your packet. Throughout the panel, if you have 2 a question, you can write it down, pass it to the 3 closest end of your row, raise your hand like you're in 4 school, and one of the FTC staff members will pick it up 5 and give the card to me. So, if you need additional 6 cards, you only have two right now, there are some where 7 you checked in. 8 So, without further adieu, let's begin. 9 MS. HUTCHINSON: Good morning, ladies and 10 gentlemen. I'm Sue Hutchinson from EPCglobal. We are a 11 neutral, not-for-profit standards body that's working on 12 technical standards for RFID and the information systems 13 that support RFID. As part of my role at EPCglobal, I 14 have the pleasure of working with a broad array of 15 manufacturers, distribution partners, retailers, 16 logistics people, hardware companies, software companies 17 and integration partners throughout the world, all 18 interested in driving towards a single set of technical 19 standards for RFID and the information systems that 20 support them. 21 So, you ask yourself, what is it about RFID that 22 is so interesting to so many businesses around the globe 23 that we're able to come together in such a cooperative 24 fashion? I thought I would start this morning with a
25 brief videotape to kind of give you a feel for what's For The Record, Inc. Waldorf, Maryland (301) 870-8025 13
1 exciting the supply chain about RFID. 2 (Videotape played for the workshop 3 participants.) 4 MS. HUTCHINSON: Great. So, as the video 5 pointed out, what we're here to talk about when we talk 6 about RFID fundamentally is visibility and increasing 7 the visibility within the supply chain around the globe. 8 Now, with increased visibility, we look at two primary 9 benefits. One is efficiency. If I can see where 10 products are moving around the supply chain, I can be 11 more efficient in the way that I move them, enhancing 12 the ability for those products to make their way onto 13 the shelf for consumers in a more rapid fashion. 14 More importantly, if I get better visibility in 15 the supply chain, it helps me know where things are 16 going and how fast it takes to get there. I can 17 decrease the amount of safety stock or excess inventory 18 that I hold "just in case" at various points in the 19 supply chain. I can be a lot more efficient with the 20 way that manufactured goods move from the manufacturer 21 through distribution out to the final retailer and 22 ultimately to the consumer. 23 The other thing that visibility gives me is 24 assurance, not only assurance of where those products
25 went, but they are, in fact, the products that I meant For The Record, Inc. Waldorf, Maryland (301) 870-8025 14
1 to send through the supply chain. 2 Let me finish this morning with a brief analogy, 3 my tale of two pens. Now, pen number one I find out was 4 manufactured here in the United States, and it went to a 5 wholesaler, went into the distribution system of my 6 local Staples, made it into the back room of Staples and 7 then finally onto the shelf. 8 Pen number two was manufactured in Mexico. It 9 was shipped to Canada where it was private-labeled by 10 another manufacturer, made its way to that same 11 distribution center and ultimately into the back room of 12 my local Staples store. 13 Now, these are pens, so ultimately I don't care. 14 I was just happy that they made it to Staples and I was 15 able to pick up a box of them when I was running out. 16 If instead of pens we were talking about 17 electronic components going into a computer system or a 18 navigation system for an airliner or we were talking 19 about prescription drugs or beef or even green onions, 20 the ability to know the source of where those things 21 came from, where they went and how they got to me as a 22 consumer has a lot more importance than it did with just 23 my two simple pens from Staples. 24 So, that's what we're going to hear during the
25 course of the day from the rest of our panel of For The Record, Inc. Waldorf, Maryland (301) 870-8025 15
1 technical experts and the rest of the panels today, is 2 to talk about simple supply chain visibility, how do we 3 become more efficient and more effective at moving goods 4 through the supply chain, through our global supply 5 chain, ultimately making them available to consumers in 6 a more expedient fashion, and how do we provide that 7 level of assurance, that chain of custody that lets us 8 know for certain that the goods we are about to 9 purchase, the goods we are about to use, are the goods 10 that were really meant for us. 11 Thank you. 12 DR. ENGELS: Thank you, Sue. Technology 13 problems always get us in the end. This is actually 14 perfect for the segue into talking about the technology. 15 One of the interesting things about RFID 16 technology is what Sue's just talked about, we're going 17 to be able to identify products uniquely, we are going 18 to be able to track and trace them throughout the entire 19 supply chains. That's a beautiful vision. That is 20 actually the vision of the Auto-ID Labs, vision of 21 EPCglobal. We're going to be able to improve our lives 22 by using RFID and by using the system behind that in a 23 secure and wonderful fashion. 24 Unfortunately, though, realities with the
25 technology, just as the realities with the technology For The Record, Inc. Waldorf, Maryland (301) 870-8025 16
1 here, there's realities -- thank you very much -- there 2 are realities with the technology of RFID. For those of 3 you that have stood in line at a checkout counter and 4 watched bar codes get scanned and scanned and scanned 5 over and over again before the checkout person types in 6 the number, you understand that technology is foulable. 7 RFID is not the panacea. It is an enable technology 8 that has its limitations. 9 As has been stated before, RFID is not a new 10 technology. It has its roots dating back into all of 11 the wonderful electromagnetic radar radio 12 communications. The first large-scale deployments of 13 RFID technology were EAS systems back in the sixties, 14 the first large-scale technology of identification -- 15 EAS has been called the one-bit, it's really half-bit, 16 identification technology. Either it's being read or 17 it's not. 18 The true RFID with unique identifiers first 19 really appeared commercially in the mid to late 20 seventies, and it's been used commercially ever since 21 then. You know, this is not a new technology. It's 22 been around for quite a long time, and in fact, if you 23 buy Ford automobiles, every time you use a Ford 24 automobile, you're using RFID. There's actually an RFID
25 tag embedded in that key of yours that's read when you For The Record, Inc. Waldorf, Maryland (301) 870-8025 17
1 put it in the ignition, and that's actually part of your 2 anti-theft system. You need that key, you need that 3 RFID tag to be able to start the car. So, it's not a 4 new technology. We should all be very, very familiar 5 with it, but it's going to become more ubiquitous. 6 But I'm here to talk about the functionality of 7 RFID and really to give you a feel for why is RFID not 8 this panacea, not this wonderful technology where 9 everywhere I go, I can read everything I want to. 10 Well, first, what is RFID technology all about? 11 The functionality it has on it is a little bit of 12 communication device. RFID tags communicate wirelessly. 13 Just as your cell phone has an antenna, RFID tags have 14 antennas. This is how they communicate with readers. 15 They typically have an identifier on them. This 16 is radio frequency identification, after all. RFID tags 17 will often have a mechanism for communicating with local 18 tags in the field to be able to communicate with the 19 same RFID reader at the same time. This is referred to 20 as anti-collision algorithms. Some are better than 21 others, and this is really a way that you can gain 22 benefits of RFID by having multiple tags and being able 23 to identify all of them, communicate with all of them. 24 Unlike bar codes, if you put lots of them in the field,
25 you really need to simulate them before you can really For The Record, Inc. Waldorf, Maryland (301) 870-8025 18
1 read them. 2 Now, advanced RFID technologies, more expensive 3 technologies, can have on-tag memory. This is great for 4 storing mission-critical information or caches of 5 information. They have more functionality and they have 6 algorithms on the chip itself, maybe on collecting data, 7 maybe on-board sensors. It's really depending upon how 8 much you want to spend, how much money you want to put 9 into it, how much functionality you want to design into 10 it. 11 At the high end of RFID, you'll get -- and like 12 I say, this is really what a cell phone is. A cell 13 phone has RF communication. You've got your antennas. 14 It's got an identifier on it, in fact, a unique 15 identifier -- most cell phones today have unique 16 identifiers, and it's got additional functionality. You 17 can actually do voice over the network, and it has a 18 built infrastructure, et cetera. It's a perfect 19 analogy. It really is an RFID device. 20 Now, because you've got this range of potential 21 functionality, RFID devices are typically classified as 22 passive, semi-passive or active. This is really 23 referring to A, where do they get their power source, 24 and B, how do they communicate.
25 Passive tags are the cheapest. They have no For The Record, Inc. Waldorf, Maryland (301) 870-8025 19
1 on-tag power source, no battery, et cetera. They 2 harvest energy from the reader's communication field. 3 They typically do not have significant amounts of 4 functionality. That is, on-board sensors typically are 5 not part of the passive device, because it's only 6 operating when the tag has power, that is, when it's in 7 the reader field. 8 Semi-passive still communicate passively, so it 9 is not actively sending out a communication signal like 10 a cell phone, but they have an on-board power source 11 that goes into one sensor, so they can keep a 12 temperature history, run algorithms, has more 13 functionality. This is very crucial when you're talking 14 about the history of a device, particularly when it's 15 out of communication range with a reader, very important 16 in the cold chains, pharmaceuticals, et cetera. 17 Then, of course, active communication. Active 18 is basically like a cell phone. You actively send out 19 information. You can communicate with one another, and 20 in the extreme, this may even be tag-to-tag 21 communication. This is your ad hoc sensor networks type 22 of functionality. Really this is the gamut of 23 functionality. And RFID is a very, very broad swath of 24 functionality, so from very, very inexpensive, low
25 functionality, this is the identity tag being used by For The Record, Inc. Waldorf, Maryland (301) 870-8025 20
1 Wal-Mart and being put on by the suppliers as well as 2 many other retailers, this is what we're first 3 developing as part of EPCglobal, and then we can move 4 into the higher functionality, higher cost systems as we 5 move forward. 6 Now, ultimately, the performance of an RFID 7 system is determined by the regulations upon it. The 8 more power you put out for communication, the longer 9 your communication range, the more tags you can power, 10 the more stuff you can go through to be able to 11 communicate. There are three basic regions around the 12 world, fairly similar in their regulatory within a 13 region, but not necessarily the same exactly between 14 regions. 15 When we talk about RFID, what are the main 16 frequencies that are used? There is actually a range of 17 frequencies. Each have advantages and disadvantages. 18 We're probably all very familiar with 13.56 and 125K 19 megahertz. These are low frequency LF and UHF actually. 20 These are very short-range communication systems, low 21 data rate systems. These are the access control systems 22 used. These are what are used in the mobilization 23 systems in your cars. So, it's not all new technology. 24 Now, we want long-range communication for supply
25 chain, for example, we're going to use higher For The Record, Inc. Waldorf, Maryland (301) 870-8025 21
1 frequencies, around 900 megahertz, for example. Again, 2 great for long-range communication for passive systems 3 but has limitations, of course. And there are other 4 frequencies around the world where you may be able to 5 use active communication, but power is such that you're 6 not going to be use passive communications at those 7 frequencies. 8 We're talking a lot about passive RFID systems, 9 because that is the system that is going to be used in 10 very, very short order in retailers and is being adopted 11 by retailers around the world. When we talk about a 12 passive system, there are basically three components. 13 The tag, which is what you put on the object to be 14 identified; the readers, which is what you use to 15 communicate with those tags to gather information; 16 typically the object identifier, so the reader knows 17 where it is and the time it read it; and then you have 18 the applications systems, which take that information 19 and do something intelligent and useful with it. 20 Now, the tags themselves just have, you know, at 21 the lowest cost, again, just have an RF interface, 22 that's the communication, some sort of control for the 23 communication, and maybe an application subsystem, that 24 is, maybe an anti-collision algorithm. The readers have
25 the interface communication control, application For The Record, Inc. Waldorf, Maryland (301) 870-8025 22
1 subsystems, they maybe do some filtering, et cetera, and 2 then network connection. That is, they can take that 3 information that they've gathered and communicate it 4 back to the application system, and then the application 5 systems do something intelligent with it. 6 Passive systems, again, obtain their power or 7 harvest all of their energy from the reader's 8 communication signal. That is, if they are not close 9 enough to the reader's communication signal, they're not 10 going to be able to get enough power to power up to sync 11 and to be able communicate with the tags. And again, 12 power is regulated by local regulatory agencies. So, 13 distance is really determined by what type of operating 14 environment you're in. 15 We're talking a lot about "reader talks first" 16 technology. That is, a tag is only communicating when 17 it's told to do so by the reader. There are reader talk 18 first systems or, I'm sorry, tag talk first systems, and 19 that is when a tag enters a field, it will start 20 communicating. If we're talking about extreme high 21 densities of tags, those systems tend to be more 22 inefficient, which is why reader talk first systems are 23 being widely used and looked at as the deployment system 24 of choice.
25 And of course, when we talk about an identity For The Record, Inc. Waldorf, Maryland (301) 870-8025 23
1 tag, the tags being initially adopted, we're just 2 talking about tags that have an object identifier. So, 3 the data that they're communicating back is just tag 4 identity or object identity, very limited amount of 5 information on them. 6 And since UHF is the top of the discussion for 7 today primarily, because that's what's being widely 8 deployed, let's look at it a little bit closer. Some of 9 the advantages of using the 900 megahertz frequency 10 spectrum is it really is the best available frequency 11 range because of regulations for communication or 12 identification of objects greater than one meter away. 13 When you think about supply chains, back rooms, 14 warehouses, DCs, pretty much you're at least a meter 15 away wherever you are. It's very effective around 16 metals or can be made very effective around metals, but 17 again, requires good system design to work. If you put 18 the tags right next to the metal without designing the 19 system properly, you are not going to read it at all. 20 So, you have to use very good system design to make it 21 work around metals. 22 The range, again, is limited by power 23 regulations. In the U.S., you can get up to about ten 24 meters. One of the best systems on the market, best
25 case scenarios today, are ten meters. This is no For The Record, Inc. Waldorf, Maryland (301) 870-8025 24
1 obstructions, wind blowing the right direction, no RF 2 interference in any way, have very clean environment, 3 ten meters is about the best you're going to get. 4 Practically, this means that you're going to get 5 about three to five meters in a normal operating 6 environment. You can get more, you can get less. It 7 really depends on the tag design, the reader design and 8 the interference of the system and the environment. 9 It's really good for non-line of sight 10 communication. That is, you can read it through 11 obstructions. You can read it through cardboard. You 12 can read it through most objects, which makes it very, 13 very good for identifying all the cases on a pallet, 14 particularly as they're going through a back door or as 15 they're coming down a conveyor belt. 16 It has a high identification rate, which makes 17 it very good for reading tags in a high-density 18 environment, moving through, again, cases on a pallet, 19 where every case is tagged. And you can actually 20 reasonably control the read zones. That is, if I want 21 to read around a dock door, I can usually control the 22 dock door environment. 23 Some of the major disadvantages of UHF 24 communication is that it's absorbed by water. That is,
25 if you want to communicate with tags that are located For The Record, Inc. Waldorf, Maryland (301) 870-8025 25
1 around cola or water or other liquids, if you've got the 2 tag down near the liquid, you better be looking directly 3 at the tag; otherwise, you are not going to read through 4 that obstruction. That is, the water is going to absorb 5 the energy. 6 So, if you want to steal these tags, really what 7 you need to do is take them and put them in your armpit 8 and walk out the door. The reader is not going to be 9 able to read it, you know, a human is 90 percent water, 10 so it's a beautiful way to obstruct tags. That's by its 11 system design, if you rely upon the EAS systems just to 12 do that, though. No offense, Stan. 13 Now, while you can reasonably control the read 14 zones, it's also difficult to control. That is, if I'm 15 trying to read a passive tag going through a dock door, 16 while I can design the system to work around metal, 17 metal is also a beautiful reflector of this energy. I 18 can take this tag that I've got ten meters away, sitting 19 not even close to the dock door, and just because I've 20 got, you know, somebody's belt buckle -- they've got a 21 nice beautiful belt buckle, they walk by the reader 22 environment, I can get a beautiful bounce and I can read 23 this tag. It's a very unusual thing, that you can get 24 stray reads with UHF technology. So, I can control the
25 reading environment reasonably well. I also get some For The Record, Inc. Waldorf, Maryland (301) 870-8025 26
1 spurious reads because of the nature of the technology, 2 the nature of the communication. 3 Now, for the EPC identity tag, some of the key 4 features of the identity tag features developed by 5 EPCglobal and the Auto-ID Center, it's being adopted by 6 corporations such as Wal-Mart, Albertson's, Target, 7 where really the major retailers are driving its use 8 within the supply chain. 9 The EPC identification tag has an EPC identifier 10 only as its data content. That is, it's got an object 11 identifier on it so I know what item I have, down to the 12 inches level on an EPC, and purportedly for consumers, 13 I've got a kill functionality. So, when I buy that tag, 14 buy that object, I can have it killed electronically. I 15 don't have to find the tag and rip it apart. I can just 16 issue a kill command, and it will basically commit 17 suicide. A little puff of smoke comes out -- I'm sorry, 18 not the puff of smoke. 19 Now, for retailers, initially it's not going to 20 be a worry, because these are not going into consumers' 21 hands, but it is there, a feature that's been put in 22 specifically to alert them, so that if you don't want 23 these passive, promiscuous tags on your body, you just 24 kill them, and that feature was designed directly into
25 the EPC protocol specifically for that consideration. For The Record, Inc. Waldorf, Maryland (301) 870-8025 27
1 So, a quick summary now that I've bored you with 2 some nice technical detail. RFID technology really does 3 have a long history. It's been in use for more than 30 4 years commercially in many applications. It has touched 5 your life whether you realize it or not. The systems 6 have great performance in some regions, not so great 7 performance in others. It's really the regulatory 8 requirements and limitations that determine the 9 performance of these systems. 10 Passive tags, again, harvest energy from a 11 reader communication signal. This is very important, 12 because it means that it's really a not particularly 13 reliable communication medium. Many obstructions, many 14 variabilities in the environment can cause you not to be 15 able to read a tag. 16 Again, the 900 megahertz passive tags being 17 required for many retailers are in, best case scenario, 18 less than ten meter read range, and they can be shielded 19 by metals and by liquids. 20 Thank you. 21 MR. ALBERS: So, good morning. My name is 22 Manuel Albers. I'm with Philips Semiconductor, and 23 Philips is one of the leading manufacturers for those ID 24 chips that Dr. Engels just referred to. I should
25 probably show you one slide that we have. For The Record, Inc. Waldorf, Maryland (301) 870-8025 28
1 Philips Semiconductors is a division of Royal 2 Philips Electronics, one of the leading electronics 3 companies in the world. I think it's about number three 4 in the world, and is one of the top ten semiconductor 5 manufacturers worldwide, and when it comes to 6 identification technologies, we are one of the market 7 leaders here with a track record of about 1 billion 8 identification chips supplied into the market to date, 9 so that's with respect to Dr. Engels' point of the 10 technology is already out there around us, and I will 11 now share with you where we already see this kind of 12 identification technologies today and what kind of 13 features make up these different types of identification 14 technologies. 15 In general, when we talk about identification 16 technologies, we are talking either about people who we 17 connect through the means of identification technologies 18 to services or we're talking about objects or goods that 19 we identify and track through the means of 20 identification technologies. 21 When we look at these two types or two classes 22 of identification technologies, in the first place, for 23 the people, we are talking typically about the type of 24 smart cards. So, it's a feature that we are already
25 pretty much familiar with here in Washington, D.C., For The Record, Inc. Waldorf, Maryland (301) 870-8025 29
1 where you use it for the public transportation, it's a 2 smart card form factor, but it can also come in a smart 3 token that you present to a smart com, for example, 4 either for, you know, for the payment of your gas 5 purchase or as a means of a loyalty system to collect 6 points. So, these form factors are being used to 7 identify people and to grant them access to services. 8 On the other hand, we talk about RFID, and RFID 9 is all about identification and tracking of objects. 10 These technologies have a purpose and have feature sets. 11 When we're talking about smart card technology, 12 you typically then talk about a contact with a smart 13 form factor or it can also be a token that can be easily 14 inserted into a cell phone. You have -- what you find 15 or what the goal is here is a combination of security 16 and convenience, so that you have a secure means to 17 access services, but at the same time, also make it 18 convenient for you, so that you can, for example, even 19 leave -- you can put the smart card in your purse or in 20 your wallet, and you present it to a reader when 21 entering the subway. 22 Typically, you find operating distance for these 23 kind of contactless smart cards of about three to four 24 inches or ten centimeters. What is important here is
25 that when you identify people or when people access the For The Record, Inc. Waldorf, Maryland (301) 870-8025 30
1 services is whether they're secure, and in order to make 2 it secure, you're talking about different features and 3 different functionalities. 4 So, for example, first of all, when you present 5 the card to a reader, you want to make sure before the 6 communication happens in between the reader and the card 7 that both are allowed to talk to each other, so you have 8 a neutral authentication. So, you really have to make 9 sure, yes, I am allowed to talk to this reader, and the 10 reader has access to this card, which means he needs 11 keys for this. 12 What you are also going to encounter are 13 encryption schemes. So, once both the card and the 14 reader have authenticated themselves to each other, they 15 talk in an encrypted way, so that somebody who stands 16 next to it and wants to listen in, they can capture the 17 communication, but they cannot understand it, because 18 it's encrypted. 19 Another means for protection is a password, to 20 also make sure that you as a cardholder are also the one 21 who's authorized to get access to the data on the card. 22 So, you will have, for example, on the one hand, you 23 need to hold the card, and on the other hand, you need 24 to pass it in order to access memory in the card when
25 you present it to a reader. For The Record, Inc. Waldorf, Maryland (301) 870-8025 31
1 And lastly, what you also see are those design 2 features on the chip itself, so you make it very hard 3 for people to try to break into that IC and to try to 4 steal information out of the chip. So, you will have 5 countermeasures on the chip level itself when you design 6 and manufacture the chip that makes it very secure. 7 All of these features, however, also have a 8 consequence. They typically drive the cost of such an 9 IC. So, that's why you typically see the other costs of 10 a smart card or of a smart token more in the range of 11 more than a dollar and all the way up to $20-plus, 12 depending on all the design features that you may 13 include in the chip but also in the card itself. 14 Applications that we see out there, and I 15 referred earlier to the point that we have already 16 supplied some 1 billion RFID chips or contact 17 identification chips, so where did they go? The bulk of 18 them to date have gone into these kind of services for 19 contactless smart cards to securely and conveniently 20 grant people access to services. Public transportation 21 is one of the main applications worldwide today. Just 22 like in Washington, there are many other cities around 23 the world who are already using this technology, 24 primarily in Asia-Pacific and in Europe, but also
25 increasingly now in the U.S., with not only Washington, For The Record, Inc. Waldorf, Maryland (301) 870-8025 32
1 D.C., but also San Francisco, San Diego, Los Angeles, 2 Boston, Atlanta and many other cities, including Las 3 Vegas, are now going this way. So, this market today is 4 worth about 500 million cards already. 5 Then you have payment applications, and you 6 might have -- we have already seen announcements from 7 both MasterCard, Visa and also AmEx to provide you with 8 a contactless smart card that allows you to pay just by 9 waving your smart card over a reader, for example, at a 10 quick service restaurant, or in the future probably at 11 the Starbucks, at the pump, and then that's where speed 12 actually is important. 13 Another large area is access control, so a 14 card -- you could be holding it in your wallet in order 15 to access your office or something in the morning, and 16 in a similar way, Dr. Engels also referred to cards for 17 authorization. This market is probably also worth about 18 300 to 400 million transponders today to the various 19 callup manufacturers and respectively to the car 20 manufacturers that allow you to securely access your 21 car, with not only the mechanical lock but also there's 22 an electronic lock that requires a transponder when you 23 slide in your car key. 24 Then the next step, you are going to get rid of
25 your car key entirely. You will just merely contact the For The Record, Inc. Waldorf, Maryland (301) 870-8025 33
1 smart card that you either carry in your purse or your 2 pocket, and when you approach the car, it opens already 3 the door for you, and because it realizes it is you, it 4 also adjusts the seats for you, adjusts radio stations, 5 and if you approach your car from the rear end, it opens 6 the trunk for you, depending on how you have set the 7 features. 8 And lastly, and this is probably the most 9 ubiquitous application that we are going to see for 10 contactless smart card technology, are our passports, so 11 the U.S. Government personnel require and all other 12 countries to deploy smart visas, also passports, that 13 are able to hold your credentials, like your fingerprint 14 or picture of the passport holder on a chip inside the 15 passport, and when you come to the border entry, you 16 present it also to a reader, just like your contactless 17 smart card, and the officer is going to be able compare 18 your face with the picture that is stored on the chip 19 inside the passport. So, that is the people side of 20 contactless identification technologies. 21 Now, when we look at the object side or the 22 goods side, we really look at the RFID technology. It 23 has a different focus. On the RFID technology side, we 24 are typically talking about a smart label form factor,
25 and to use one example on the picture that we see here, For The Record, Inc. Waldorf, Maryland (301) 870-8025 34
1 it can also have various other shapes and form factors. 2 Typically compared to the secure identification 3 smart card technology, here you're talking about the 4 functionality that Ms. Hutchinson earlier referred to as 5 license plate information. So, really it's typically 6 just a number that allows you to securely identify a 7 specific good or product. 8 In addition to that, you can find additional 9 memory residing in the chip that allows you to store 10 more information about the product inside the chip. For 11 example, before a manufacturer ships his product to a 12 Wal-Mart, he wants to probably also make use of that 13 RFID label going through his own supply chain, and for 14 example, use that memory as a checklist when it runs 15 through his own production, and at the end of the day, 16 he will see that information again before he ships it 17 out to Wal-Mart or to another retailer. 18 We find low to moderate security features, 19 because these labels and these RFID tags are all about 20 cost, and the less functionality you have on the chip, 21 the cheaper you can make it, and thus also the cheaper 22 the label is going to be. 23 So, the basic security features that you can 24 find on these kind of chips are memory write protection,
25 so that not everybody can just add information to that For The Record, Inc. Waldorf, Maryland (301) 870-8025 35
1 chip, or a very basic encryption scheme. Also on these 2 IC features is a destroy feature or kill switch, as has 3 been referred to, that destroys all of the functionality 4 of the smart label. 5 The reading distance is medium to long, so about 6 20 feet, and as Dr. Engels referred to, you can also get 7 up to 30 feet, but this is really under optimum 8 conditions. And again, it's typically for very low cost 9 applications, and the price ranges right now are for 10 RFID tags coming down from $2, all the way down to what 11 is required today for the retail environment, closer to 12 5 cents or a couple of cents. 13 Applications that you see out there today range 14 typically from supply chain management and the various 15 kinds of supply chain management, being manufacturing 16 automation, warehouse automation, processing services, 17 baggage checking in airport, which is now becoming more 18 and more popular and efficient, and on the other hand, 19 you have asset management. 20 Most normally it's library automation, where you 21 have self check-in and check-out terminals with books 22 that you can take out of the library, but at the same 23 time, you can also do automatic inventory control at 24 libraries and identify books and those that have been
25 misplaced just by hitting a switch or also by walking by For The Record, Inc. Waldorf, Maryland (301) 870-8025 36
1 a shelf with books with a reader that allows you to 2 identify the book that is placed in the wrong space. 3 If you have any questions, please also feel free 4 to contact me by email. You will find my email address 5 here in the slides, and I believe these slides are going 6 to be posted on the Web, right? 7 MS. BROF: Yes. 8 MR. ALBERS: Okay, thanks very much. 9 MS. BROF: Thank you. We just have a couple of 10 questions. 11 When you're talking about read/write capacity, 12 does that relate to the memory function on a tag, and 13 how does that work? 14 DR. ENGELS: With regards to the read/write 15 capacity, that really is dependent upon how much memory 16 is actually on the tag. When you write to silicon, you 17 can, again, use the RF interface for it, and the read 18 range is typically significantly reduced for the write 19 functionality, because it requires more power to 20 actually write to most memory technologies in use today. 21 Reading is simply trying to read out 22 functionality or read out the memory contents, and when 23 you think about how much memory is actually there, 24 again, it's variable. Many technologies on the market
25 today have sort of kilobytes or more of memory. The EPC For The Record, Inc. Waldorf, Maryland (301) 870-8025 37
1 identity tag has just enough memory to store an object 2 identifier and an error detection code, typically on the 3 order of less than 128 bits of information. 4 MS. BROF: And when you talk about the 5 information that can be accessed from a tag and we're 6 talking about literally like a number or an 7 identification number, but the meaning of that 8 information only comes really when it's then linked to a 9 database with additional information, and how does -- if 10 the database is needed, what kinds of protections are in 11 place to limit access to it? 12 And if you're operating under a system where any 13 reader can read any tag, with then the next step being 14 getting meaning behind what information is on the tag, 15 how does that work or what kinds of protections exist? 16 MS. HUTCHINSON: We've been using the analogy 17 this morning of that simple identifier on the RFID tag 18 being like a license plate number. Well, if you have a 19 license plate number, you have to have a Department of 20 Motor Vehicles somewhere to provide the context for what 21 that number means, and this is literally the mechanism 22 that we use in the EPCglobal network. So, that small 23 identifier, that 96 bits of information that is held on 24 an EPC tag, is our key to a naming service that's called
25 the object naming service, works very much the way that For The Record, Inc. Waldorf, Maryland (301) 870-8025 38
1 your internet browser works today with the domain naming 2 service, to translate a URL into a location somewhere on 3 the internet to be able to find the information, the 4 same thing is true with the object naming service. I 5 can go from that simple license plate number to a 6 location. 7 So, for example, if I have a product that came 8 from Procter & Gamble, as that tag is scanned, part of 9 the number that's on that tag may come up with the 10 number 0037000, which I can send to ONS, and it says, 11 oh, the information that you're looking for, you're 12 seeking, is in a server within the Procter & Gamble 13 network. So, we're talking about a server that is 14 behind the firewall at Procter & Gamble and very well 15 secured, because we're talking about some fundamentally 16 very sensitive business information. 17 By being part of the EPCglobal network, I get my 18 authorization and my digital certificate to be able to 19 then go as a retailer or another supplier or someone in 20 logistics, to be able to go to that network and ask for 21 more information about that number that I just read off 22 the tag. So, most importantly, the information is not 23 on the tag. It is secured behind the firewalls of 24 corporations, logistics providers and retailers all
25 around the globe. For The Record, Inc. Waldorf, Maryland (301) 870-8025 39
1 MS. BROF: And now I have a couple of questions 2 about the kill function, first just basically explaining 3 how that works and who has the authority to kind of 4 exercise that kill function or who I guess issues the 5 command, then sort of two sides of the same coin, can it 6 be re-activated, you know, kind of re-awakened, and 7 then, would it be easy for someone to issue the command 8 and destroy all the information, you know, or the 9 ability to get information that would be useful, but 10 maybe you shouldn't be able to do that. 11 DR. ENGELS: So, the kill functionality is a 12 passport-protected command, so the reader can actually 13 issue the kill command in normal command functionality 14 mode, but a specific password is required of it as well. 15 That password in the next generation will be 32 bits in 16 length, and effectively that means it will take you 17 several hours to guess the correct password to be able 18 to kill a particular tag. 19 Dead does mean dead. Actually, I had a long 20 conversation this morning about zombies and other 21 ghostly features and characteristics of RFID tags, but 22 no. Dead means dead forever and forever. Once a tag 23 has been killed, if it is compliant with the EPC spec, 24 it will never modulate back. So, it will never
25 communicate ever again forever, never. So, the tag For The Record, Inc. Waldorf, Maryland (301) 870-8025 40
1 information will never be modulated again by the tag; 2 that is, it will never be able to communicate any 3 information. 4 One functionality that has been talked about is 5 that you can even erase the information as well if you 6 have a like memory technology, is when you kill 7 yourself, you kill the tag, you use the correct 8 password, and then the tag erases all of its memory 9 contents, so that even a forensic electron beam analysis 10 of the tag will never receive what number was actually 11 stored on it and that it committed suicide as well. 12 Now, who actually has the authority to issue 13 kill commands? The answer is the owner of the tag. So, 14 if you own the tag, you have the authority to kill the 15 tag any way you want to, physically or electronically. 16 If you do not own the tag, you definitely do not have 17 the authority to kill anything. Just as it is with 18 items today, you are not legally allowed to destroy 19 items that you don't own. Even some that you do own, 20 you're not legally allowed to destroy. So, those are 21 the three tenets of the question. 22 MS. BROF: And I know we have our break in one 23 second, but I just wanted to follow up, when you said 24 the owner of the item, I guess, has that authority, I
25 mean, would that be a system where consumers would have For The Record, Inc. Waldorf, Maryland (301) 870-8025 41
1 pins that they would use to exercise it? 2 DR. ENGELS: If you as a consumer own a tag, you 3 have the authority to kill that tag, and when you 4 purchase it from somebody, you should either have them 5 kill it for you if you want it as such or they should 6 have transferred to you the correct password so that you 7 can kill the tag yourself at some later date. 8 I believe most stated retailer plans with 9 regards to kill functionality is that the retailers, 10 when they sell an item that has a tag on it, will kill 11 the tag at point of sale before it ever leaves the 12 building. 13 MS. BROF: And the last question, changing 14 topics, what's the status of the EPCglobal standard 15 specification? 16 MS. HUTCHINSON: Sure, the Version 1 of all the 17 specifications for the communication between the tag and 18 reader as well as some common data elements and common 19 communication techniques for those information systems 20 that we talked about were modified by the EPCglobal 21 Board of Governors last November, and there are 22 currently more than 20 vendors worldwide that are 23 already selling tags and readers to those 24 specifications.
25 This is a technology in its infancy, though, and For The Record, Inc. Waldorf, Maryland (301) 870-8025 42
1 as we deploy the technology, as we learn more in 2 implementation, we continue to revise those standards to 3 address what we're finding in our early implementations, 4 things like consumer concerns about privacy. So, we're 5 actively working on a second generation of all of those 6 standards, the first of which is due out later this 7 summer. We're probably looking at a second revision for 8 all of the standards related to the network before the 9 end of this calendar year. 10 MS. BROF: Well, thank you very much. That was 11 a good grounding, I think, for the rest of today, and we 12 have about ten minutes now before our second even longer 13 panel, so if you want to take a coffee break, we'll 14 reconvene at 9:45. Thank you very much. 15 (Applause.) 16 (A brief recess was taken.) 17 PANEL 2 18 MR. HARWOOD: Good morning. My name is Chuck 19 Harwood. I'm the director of the Federal Trade 20 Commission office in Seattle, and I'm pleased to be here 21 today to greet all of you. 22 This is our second panel of the day. It's on 23 current and anticipated uses for RF technology. For 24 this panel, after we finish this panel, you'll have a
25 sense of the breadth and scope of RF technology For The Record, Inc. Waldorf, Maryland (301) 870-8025 43
1 applications or implementation, both currently and in 2 the near future. 3 We have a distinguished panel who will be 4 speaking with us today. I'm joined first of all by my 5 co-moderator, who is Lyle Ginsburg -- right, thank you, 6 trying to find my notes and talk at the same time, and I 7 don't read and talk well at the same time apparently -- 8 and Lyle is the managing partner for Technology 9 Innovation in Accenture's Global Product Operations 10 Group. He was Accenture's board member at the Auto-ID 11 Center, now represents the company to EPCglobal. As I 12 said, he is the co-moderator, and he will be asking some 13 of the questions today. 14 In addition to Lyle, on the panel we have Britt 15 Wood. Britt is a Senior Vice President of Industry 16 Relations for the Retail Industry Leaders Association, 17 a/k/a RILA, R I L A. He's been with RILA since 1995, 18 and he also serves as RILA's main representative on 19 several external industry-related committees, including 20 the EPC Alliance for the last four years. 21 The third speaker or the second speaker, 22 actually, on the panel, is Simon Langford. Simon is the 23 Manager of RFID Strategy for Wal-Mart Stores, Inc. 24 Simon is responsible for the integration of EPC into
25 Wal-Mart systems. For The Record, Inc. Waldorf, Maryland (301) 870-8025 44
1 The third panelist is Bill Allen. Bill is the 2 Marketing Communications Manager for Texas Instruments 3 (TI) RFID Systems. In this position, he's responsible 4 for the marketing communication strategy and managering 5 TI RFID's public relations advertising and trade show 6 involvement. 7 The fourth speaker is Ken Fishkin, who's on the 8 other side of the -- well, he's down there, okay. Ken 9 Fishkin, he's a researcher at Intel Research in Seattle 10 and an Affiliate Professor of Computer Science at the 11 University of Washington. He has 15 years of experience 12 in industrial R&D. 13 The fifth speaker is Paul Rudolf. Paul became 14 Senior Adviser For Medical and Health Policy in the 15 Office of Policy at the Food and Drug Administration in 16 July 2003. He was a member of the FDA's Counterfeit 17 Drug Task Force. 18 The sixth speaker is Lee Tien. Lee is a senior 19 attorney with the Electronic Frontier Foundation in San 20 Francisco, California, specializing in free speech and 21 privacy. 22 And our final panelist member is Peter Sand. 23 Peter serves as the Director of Privacy Technology in 24 the Privacy Office of the U.S. Department of Homeland
25 Security. For The Record, Inc. Waldorf, Maryland (301) 870-8025 45
1 They will be speaking in the order I've 2 introduced them. Before the panelists start, I will ask 3 Lyle if he has a few thoughts he wants to share with us. 4 MR. GINSBURG: Thank you, Chuck. 5 Just a couple of context points before we get 6 started. I have a feeling that we probably wouldn't be 7 sitting here today talking about this if it wasn't for 8 Wal-Mart. Now, I think that there are all sorts of 9 great uses of RFID that have been out there for a while. 10 I use many of them. I have my RF-based identification 11 badge. I used to in my younger days run races, and you 12 used to have these chips on your shoes that would record 13 your start and finish times. I have a SpeedPass, so 14 when I buy Mobil gas, I can pay for it that way, but I 15 think the reason that we're here is because of some very 16 recent events involving large-scale rollout deployment 17 programs, and you know, Wal-Mart beget the DoD beget 18 Tesco and so on. 19 So, I think that context is interesting and 20 important, and if you look at where the technology is 21 today, the current state, I think you got a pretty good 22 sense from Dan Engels about where we are. You know, he 23 talked about the fact that even 25 years later with bar 24 code, you still have these issues of scan, rescan and
25 rescan that take place, so you can imagine where RFID is For The Record, Inc. Waldorf, Maryland (301) 870-8025 46
1 given its relative infancy, certainly in the way it's 2 been talked about being deployed today. 3 So, you still get tags that get shipped to 4 buyers that don't all work, or after they're applied 5 don't work, or the performance isn't as fast as we want, 6 the read rates aren't as high as we'd like, and we can't 7 read all the things that we want to today. 8 The cost is still too high, you know, the lowest 9 published cost that I've heard about for some of these 10 tags, if you buy a million of them, is 19 cents apiece. 11 If you talk to some of these companies about purchasing 12 consortiums to drive the numbers up into the hundreds of 13 millions, you start to be able to talk about things like 14 7, 8, 9 cents apiece, but still for many companies, that 15 business case still doesn't work. We talk about even 5 16 cent tags for cases, pennies or less for individual 17 items. So, we have a ways to go on the costs. 18 Dan talked about UHF frequencies and HF 19 frequencies and how some frequencies work better at 20 distances, some work better close up, and so we have to 21 figure out if we want to start tagging individual items, 22 which frequency are we going to use, so we can track 23 something all the way through the supply chain. 24 If that's not enough, China threatens to invent
25 its own system, and if that's not enough, you look up For The Record, Inc. Waldorf, Maryland (301) 870-8025 47
1 RFID on your Google, and you get spy chips and so on. 2 So, what would any logical person conclude? Well, all 3 systems go, of course. On with the show. 4 It's kind of funny, right, that those aren't the 5 realities of today. Those aren't the relevant facts, 6 yet we are moving forward. Why is that? Well, there's 7 a pretty astounding panel that took place a couple of 8 weeks ago at ECR Brussels where the CEOs of Wal-Mart, 9 Metro, Unilever, Nestle, a few others, all talking about 10 RFID, and I'm amazed that at that level they can spell 11 RFID let alone have an in-depth conversation, which they 12 did. They were all very knowledgeable on the subject, 13 and their message was pretty loud and clear. 14 You know, we did invest in the bar code years 15 ago. It was painful when we first got started, but we 16 had to start to get to where we are today, and that was 17 really the message of where we are with RFID. So, I 18 think that sort of provides some context around why we 19 are doing this given the realities of where we are. 20 We're at the beginning of a marathon. We have a long, 21 long way to go. 22 Here's an interesting quote for one of the CEOs 23 where he said, "You know what? My CFO doesn't get this. 24 Here we are focusing on the business value and the
25 business case, and I've presented it to my CFO, and he For The Record, Inc. Waldorf, Maryland (301) 870-8025 48
1 doesn't get it." But that's not important at this 2 point, because it's going to be painful for a while 3 until we get going and we start driving the benefits 4 out, we get the scale, and we get a more robust set of 5 technology in place. 6 So, this is a global phenomenon. It's not just 7 happening here in the United States or even just in 8 Europe. There are a lot of big programs going on in 9 Europe, but we have active projects going on in Japan, 10 Australia, Brazil. Any company, let's say, in the 11 electronics industry that is part of any of these 12 programs that our panelists are going to talk about are 13 evolving, they have to engage Asia, because they have 14 manufacturing and distribution operations in Asia, and 15 so their Asian operations are going to have to get 16 involved in this. It's not just a U.S. and European 17 thing. 18 It's not just CPG. It's not just toothpaste and 19 paper towels. It involves consumer electronics, 20 electronic media, apparel, pharmaceuticals, and it's not 21 just about case and pallet-level tagging in the supply 22 chain. There are business cases and applications 23 today -- and you'll hear about some of them here -- 24 where it gets down to item-level tagging to really get
25 the business value to solve the problem. That's a here For The Record, Inc. Waldorf, Maryland (301) 870-8025 49
1 and now issue and phenomenon. 2 So, that's just a little bit of context. It's a 3 marathon that we're in. You may look at any one of the 4 individual piece parts and say, what's going on here? 5 But that's not really the point, at least according to 6 the CEOs of the companies that are actively involved in 7 this. 8 Okay, Chuck. 9 MR. HARWOOD: Great, thank you. Thank you, 10 Lyle. 11 Just a couple of comments before we start. For 12 our panelists, be sure to speak into the microphone 13 during your presentation. That's the only way are able 14 to actually get the whole thing recorded and 15 transcribed. 16 Second, if you have questions, I would encourage 17 you to -- you'll find the question cards in your 18 folders. You can go ahead and pull them out at any 19 point during the presentation and hold them up or wave, 20 and our trusty assistant in the back, Grant -- for those 21 of you who want to turn around and look, he's waving 22 now, or he was, you're too fast, Grant -- he can come 23 around and pick them up. 24 Again, I'm going to ask each panelist, again, to
25 limit their comments to about ten minutes, and Grant has For The Record, Inc. Waldorf, Maryland (301) 870-8025 50
1 a sign that he will hold up to let us know that we are 2 going over the limit. It's supposed to say "Stop now," 3 but instead it says, "Two minutes left," but that 4 doesn't mean you actually still have two minutes. It 5 means you should stop soon. 6 And finally, with regard to bios and things like 7 that, what I really did at the beginning was just the 8 first couple of lines of the bio of each individual. If 9 I read all of the bios, we would have been here for the 10 first 30 minutes. This is an incredibly impressive 11 group of panelists, and so feel free to take a look at 12 those bios, but we will begin with our first impressive 13 panelist right now. Go ahead. 14 MR. WOOD: I am Britt Wood obviously with RILA. 15 Thank you very much, Chuck. 16 Well, good morning, everyone. I hope you're 17 doing well this morning. Again, my name is Britt Wood. 18 I'm a senior vice president for industry relations for 19 the Retail Industry Leaders Association, pronounced 20 RILA. What I would like to talk to you about today has 21 several facets to it. 22 First, I'd like to tell you a little bit about 23 RILA so you can understand why I'm up here today 24 speaking to you. Secondly, I'd like to talk to you
25 about why our members are looking at RFID, why they're For The Record, Inc. Waldorf, Maryland (301) 870-8025 51
1 interested in this and some of the benefits that they 2 see related to RFID. I also want to give you a little 3 bit of a reality check in terms of talking to you about 4 where our entire industry is with regard to RFID. I 5 also would like to share with you a little bit of the 6 economics behind RFID that our retailers and 7 manufacturers are looking at. I'll talk to you a little 8 bit about some alternative uses of RFID that you may not 9 be aware of that have been discussed within our 10 membership. Finally, I'll briefly touch on what some 11 other industries are doing and then take a real quick 12 look at the future. So, let's go ahead and get started. 13 Who is the Retail Industry Leaders Association? 14 Well, RILA is an alliance of the most successful and 15 innovative retailers and suppliers in the world today. 16 Our members represent more than $1 trillion in sales 17 annually and operate more than 100,000 stores, 18 manufacturing facilities and distribution centers, both 19 domestically and worldwide. We do have facilities in 20 all 50 states as well as internationally, and our 21 members employ millions of workers both domestically and 22 worldwide. 23 Through RILA, retail leaders and the critical 24 disciplines of the retail industry work together to
25 improve their businesses and the industry as a whole. For The Record, Inc. Waldorf, Maryland (301) 870-8025 52
1 Our mission as a trade association is to serve the 2 successful and innovative retailers and suppliers 3 through world class education, innovation and advocacy. 4 So, there is my promo. I hope I made it under 60 5 seconds. 6 Who our membership is I'm sure is a little more 7 interesting than that. This is a sample of some of the 8 retailers as well as manufacturers and service suppliers 9 what we represent, AutoZone, Best Buy, Dollar General, 10 Family Dollar, Food Lion, The Home Depot, Gap, Lowe's, 11 Michael's Stores, PetCo, PetSmart, Target, Tractor 12 Supply and Wal-Mart. On the manufacturing and service 13 side, companies such as 3M, American Greetings, 14 Coca-Cola, Eastman-Kodak, Energizer, Federal Express, 15 Gillette, Hallmark, Johnson & Johnson, Procter & Gamble, 16 UPS, Unilever, Time Retail, VF Corporation and Williams 17 & Dickey. 18 So, why are folks so interested in RFID? Well, 19 it's pretty simple actually. This slide best represents 20 why our industry is taking such a close look at case and 21 pallet tagging in the supply chain. The number I'd like 22 to draw your attention to is the number in the middle, 23 the 6 to 10 percent waste that is found through lack of 24 visibility or poor visibility in the supply chain. This
25 is an issue where we believe tagging at the case and For The Record, Inc. Waldorf, Maryland (301) 870-8025 53
1 pallet level will give us the opportunity to enhance our 2 visibility, and frankly, cut into this waste. 3 So, what are the benefits? I think you've heard 4 some of our earlier panelists talk about the benefits. 5 These are what we call success factors for retailers. 6 Reduce on-hand inventory and basically reduce and have 7 less use of safety stock. For those of you who aren't 8 in retail, what safety stock is, on occasion, we're 9 known to order lots of stuff because we're worried that 10 we can't get more stuff in time when it sells out. In 11 many instances, that stuff tends to not be sold and go 12 to waste. So, that's obviously some inefficiency for us 13 there. 14 Increase sales through reduced out-of-stock. 15 Obviously if we have it on the shelf and we know where 16 it is, we can increase our sales. Increase stock 17 visibility and availability at the point of shipment, 18 suffice it to say that means if we know where it is, 19 it's going to be easier for us to ship it and transport 20 it properly. This will lead to reduced transportation 21 costs and reduction of shipping volumes, which will 22 increase our efficiency. We'll also more accurately 23 forecast, and stock replenishment will be another result 24 of this, because we will have visibility in the supply
25 chain and be better able to tell when and where things For The Record, Inc. Waldorf, Maryland (301) 870-8025 54
1 are to enhance our forecasting. 2 Finally, we'll reduce shrink and theft in the 3 supply chain, which is a large issue for our industry 4 which we grapple with every day. If we know where 5 product is and then we know when it disappears, it gives 6 us the ability to sleuth that problem. 7 Potential benefits for the consumer on case and 8 pallet tagging in the supply chain, I don't know how 9 many of you here shop, but when you go to shop, you hate 10 the feeling, as I do, when you show up and you're 11 looking for a particular product and it's not on the 12 shelf. There's a little SKU there and it says it's 13 going to be there, but it ends up not being there, 14 obviously a large amount of frustration. When we have 15 better tracking in our supply chain, that is going to 16 result less often. This will improve product selection, 17 will result from the fact of the reduction in safety 18 stock and the reduction of numbers that we may actually 19 have to keep out on the shelf, giving us the ability to 20 enhance the product selection for the consumers. 21 Product freshness on perishable goods -- 22 actually, it is -- we are noting it on perishable goods, 23 but it also works for any good with an expiration date, 24 the opportunity for us to enhance the amount of time
25 that the product is available before that expiration For The Record, Inc. Waldorf, Maryland (301) 870-8025 55
1 date is a huge benefit to consumers, as you will not buy 2 aspirin and then have it expire on you three months 3 later. 4 Finally, easier identification on recalls. At 5 the case and pallet level, if there's a recall issued 6 and we know where those cases and pallets are, that will 7 give us the ability to bring that product back and 8 increase the ability of the retailer to get to that 9 product prior to it reaching the actual customers. So, 10 those are the benefits, both for retailers and we 11 believe for consumers. 12 What I'd like to talk about now is to almost 13 give you a little bit of a reality check, and these are 14 the two words we use most frequently when we talk about 15 where RFID is in our industry. I think even Simon would 16 agree that Wal-Mart, probably being one of the more 17 advanced companies, is still very much in this mode of 18 discovery and exploration, learning something new every 19 day, but at the same time also realizing that this 20 system by no means is a sure thing at this point. 21 You have heard about Wal-Mart, you have heard 22 about Albertson's, you have heard about Target or Tesco 23 and Metro with issuing some of the mandates and also 24 looking to implement the technology within 2005 or 2006.
25 Several other retailers have pilots in the field and For The Record, Inc. Waldorf, Maryland (301) 870-8025 56
1 have not issued mandates in terms of telling their 2 manufacturers they'd like to have the cases tagged by a 3 certain time. 4 The first group I mentioned to you that I listed 5 by name are what we would call the innovators. The 6 second group are who's conducting pilots, and those 7 pilots are generally being conducted at either the 900 8 megahertz level or the 13.56 megahertz level. The 9 second group that's just conducting pilots are what we 10 would call the early adopters, and as we know in the 11 curve of adoption of technology, those are the first 12 two, and then the big portion of the curve is next. 13 The big portion of the curve, the majority of 14 the retailers who we represent are basically six to 15 twelve months away from even putting a pilot in place. 16 They're developing a plan, they're getting a team 17 together, but they're not ready to put a pilot in place. 18 They're taking a wait and see. They're trying to gain 19 some advantage by not having to learn the lessons on 20 their own, and at the same point, they are still very 21 much behind some of these innovators and early adopters. 22 Some of them are also focused on issues like 23 data synchronization, which is not a prerequisite to 24 RFID; however, without doing it, you will not reap 98
25 percent of the benefits that RFID can bring to your For The Record, Inc. Waldorf, Maryland (301) 870-8025 57
1 organization. Data synchronization is a whole other 2 topic for a whole other day, but it is something that's 3 taking an enormous amount of time from retailers and 4 manufacturers alike and is a large hurdle to overcome 5 before they get RFID in place. 6 Interestingly enough, there are some retailers 7 who frankly right now have very little interest in 8 adopting RFID at all, and so they're trying to figure 9 out the benefits for themselves, and they're conducting 10 their own studies. So, that remains to be seen, exactly 11 how that turns out. 12 The economics behind RFID, well, it's still 13 pretty expensive, as you heard, 19 cents you heard Lyle 14 say earlier, possibly buying at a million chips. 15 Generally the range we use is 20 to 40 cents for the 16 tags, and anywhere between $500 and $1,000 for a reader 17 that generally reads about six feet, three meters. So, 18 obviously that's a significant cost if you're going to 19 put that in all your distribution centers and all your 20 front doors. So, just that cost alone is what you hear 21 a lot talked a lot about in the press. 22 However, what I'd like to show you now is part 23 of a distance learning program that RILA has put 24 together which also illustrates for you the cost factors
25 involved in RFID, and I think Simon can echo these. The For The Record, Inc. Waldorf, Maryland (301) 870-8025 58
1 hardware, which you hear most frequently about, that 2 does have some significant numbers attached to it, is 3 only 3 percent of the cost. It's a small amount. 4 The other significant portions of the costs 5 include the people costs, what it takes to train the 6 people, to get them in place, to get them more adept to 7 work with this technology. And then finally, the 8 software cost is roughly three-quarters of the bill, and 9 that's not talked about frequently. So, if you can 10 imagine that those numbers that I was just throwing out 11 to you represent a very small portion of the cost, you 12 can understand that this is a hefty project to take on 13 if you're a retailer, and it gives you a little sense of 14 the reality behind the investment that's required to 15 make this work within an infrastructure. 16 Real quickly, I'd like to talk about some of the 17 talked about item-level tagging and the economic 18 feasibility behind that. In fact, to take it to the 19 extreme, there's a particular member of ours who while 20 we were in a meeting was talking about the fact that 21 they sell items that are less than 5 cents. So, why 22 would you put a 5 cent tag on an item less than 5 cents? 23 Now, obviously that's the extreme, but it even leads to 24 the fact that there's a leading technology firm that has
25 come out with a statement that they do not foresee items For The Record, Inc. Waldorf, Maryland (301) 870-8025 59
1 under $10 being item-level tagged until the earliest 2 2017. So, you get a sense of the infancy, where we are. 3 Oh, he's giving me the two minutes left. I have 4 so much good stuff, though. I'm going to go just a 5 little bit longer, I promise, and Simon will make it up 6 on his end. We made a deal. 7 So, I just wanted to give you a real quick sense 8 of the costs and everything that goes into doing that. 9 Finally, I'd like to talk real quick about the 10 alternative uses. Two things that have been discussed, 11 these have not been tested nor have they been piloted, 12 so these are simply discussions. One of them is using 13 RFID on very high-cost items for warranty information, 14 to frankly simplify the process, and that has been 15 talked about as when you give the consumers the option 16 to do that. 17 The other is, interestingly enough, you hear a 18 lot about this downflowing supply chain and using RFID 19 there. We've had some retailers express interest in -- 20 well, I would like to use RFID in my reverse supply 21 chain. In other words, once the customer returns the 22 product to me, I would then like to slap an RFID tag on 23 it and track it up through my reverse supply chain to 24 better understand the inefficiencies and waste that's
25 taking place there and tackle that. For The Record, Inc. Waldorf, Maryland (301) 870-8025 60
1 For the future, what do we see as a trade 2 organization? We see a lot of supply chain use. We see 3 a lot happening in the case and pallet level. We see a 4 little bit of testing going on in the item level. We do 5 not see widespread item adoption, widespread item 6 adoption or use for at least ten years, and I think with 7 the sense of the economics involved with this, you get 8 an understanding of why widespread item adoption really 9 doesn't make sense. There's a lot to learn in the 10 supply chain. 11 And then one final comment, the interesting 12 thing about retail is that unlike politicians who have a 13 vote that's coming up in September, our customers vote 14 with their feet every day. When it comes to RFID, we 15 want to keep them informed. It is in our best interests 16 to keep them informed, because if we do anything that 17 could possibly make our customers uncomfortable, we will 18 lose their business, and hence, it will cost us very 19 dearly. So, I just want to leave you with that, that 20 the retail industry is very interested in this 21 technology to enhance their efficiency and make the 22 customer experience better, not worse. 23 Thank you very much. 24 MR. HARWOOD: Okay, next we have Simon Langford
25 with Wal-Mart. For The Record, Inc. Waldorf, Maryland (301) 870-8025 61
1 MR. LANGFORD: Good morning. Thank you for the 2 opportunity to come here today and share with you how 3 we're using RFID right now and how we see using RFID in 4 the near term. 5 I think interestingly enough, if you think back 6 to the video that Sue Hutchinson showed, there was one 7 thing in there that really sums up the use of RFID in 8 the supply chain, and that is total supply chain 9 visibility, right from the manufacturer right through to 10 the retail store and to the sales floor, to the shelf, 11 and that really provides total flexibility either for 12 the retailer, the distribution center within the 13 retailer, third-party logistics or the manufacturer. 14 Total leverage of RFID and the benefits touch on 15 a number of these. The full potential across the supply 16 chain is enormous. There are both collaborative 17 benefits and also within four wall benefits within each 18 organization, and so in terms of collaborative benefits, 19 we spoke a lot earlier this morning about improved 20 shopper experience through better in-stock on the shelf, 21 thus providing extra sales growth not only for the 22 retailer but also for the supplier, but more 23 importantly, offering that customer service. 24 So, when a customer comes into our stores on a
25 Saturday evening to buy diapers, for example, they're For The Record, Inc. Waldorf, Maryland (301) 870-8025 62
1 there on the shelf for them. They don't have to wait or 2 ask for those to be pulled out of the back room or visit 3 a different retailer. It's that visibility that is 4 taking stock out of the supply chain, so we get in that 5 just-in-time supply of product to meet the customer 6 needs. 7 Then within Wal-Mart and Sam's, then as I come 8 to a little bit later, store efficiencies, efficiency in 9 the distribution centers, and likewise in the supplier 10 as well. So, we've got collaborative benefits and 11 internal benefits that we all need to realize. 12 If we take a snapshot of the supply chain then 13 end to end, currently we have information when we 14 receive products, when we ship products, but that's 15 fairly limited. So, for example, we can't see when a 16 supplier who's in the manufacturing process if they've 17 got an issue. We don't see when they ship a product to 18 us. 19 And third-party distribution or LTL, less than 20 trailer load deliveries, that's very cumbersome to 21 receive at a distribution center, very poor visibility, 22 not only at the DC level, but at stores and clubs. We 23 have got limited visibility of where that stock is. So, 24 for example, we know that there's ten cases of product
25 in the store. We don't know where in the store that is. For The Record, Inc. Waldorf, Maryland (301) 870-8025 63
1 Is it on the shelf or is it in the back room? Today, we 2 only know there's ten cases. 3 With RFID then, we are able to see back of the 4 supply chain, to see if there is a problem with demand 5 or production from the manufacturer. So, do we need to 6 acquire additional product to maintain availability for 7 our customers? Do we need to hire extra people to 8 receive that product when it hits our distribution 9 centers? RFID in the future will track merchandise at 10 the carriers' terminals, and it will streamline 11 receiving and check-in processes both at store and 12 distribution centers. 13 When we talk about that streamlining, we also 14 talk about accuracy as well, because as we all know with 15 bar codes, there's a human factor in there that always 16 can occur. So, getting an accurate perpetual inventory 17 or on-hand figure is crucial to replenishing stores. 18 And then in stores and clubs at peak times, we 19 have outside storage. We don't know where that product 20 is, and it takes a long time for an associate to find 21 and to replenish the shelf, but right from the word go, 22 RFID would provide that visibility of where those ten 23 cases are, sales floor versus back room. So, if we are 24 out of stock on a product on the shelf and we can see
25 that there's ten cases of product in the back room, we For The Record, Inc. Waldorf, Maryland (301) 870-8025 64
1 can dial up the associate to go retrieve that product 2 and to merchandise it, even before it gets to the point 3 of being off sale. That's enormous in itself. 4 Think about street dates as well, about having 5 readers out to the sales floor as we move from the back 6 room. If we have DVDs that are supposed to go on sale 7 tomorrow, an associate tries to take those out today, 8 the system can alert to prevent that happening. 9 The next two slides are really what a lot of 10 people are seeing already from the RFID Center, but it 11 really comes in with where we allow readers at this 12 point in time, and that is at the back door receiving 13 doors of our stores and clubs and then in the back room 14 as we move out to the sales floor. So, at case and 15 level tagging, we can reach a lot of benefits that some 16 perceive as item-level benefits just from tracking those 17 cases and the intelligence in the software. 18 And then DC visibility, as we receive it from 19 the manufacturer, we can track it through our 20 distribution centers and then outbound to the stores and 21 clubs. 22 What we've got now is a short video which we 23 shot really for our internal associates to really show 24 them our pilot that we launched recently in the Dallas
25 area, so we show end to end where our weak points are For The Record, Inc. Waldorf, Maryland (301) 870-8025 65
1 that I've just described there, but it also talks about 2 the future benefits and the future functionality that we 3 will receive from RFID, so if we can roll that video. 4 Okay, as this video is coming up, you will learn 5 things about eliminating shipping labels that we 6 currently place, print and place, on cartons that ship 7 out to our stores and clubs, and that all comes at a 8 cost, a cost to the supply of goods, which ultimately 9 the customer pays for. 10 (Videotaped played for the workshop 11 participants.) 12 MR. LANGFORD: I think from that you get a good 13 sense of why we're looking at RFID driving the 14 efficiencies and the supply to our stores. 15 Just one note on case and pallet, we do have 16 cases of products that are pack size one, so a 17 customer -- they are actually a selling item, and in our 18 pilot, we have three such items, for example, HP 19 printers, that are shipped through our distribution 20 centers as cases, and in that pilot, what we've done is 21 taken the steps to educate both our customers and our 22 associates on this, and if we can pull the slide up, we 23 can see an example here of how we've been transparent on 24 that education.
25 We've gone out with tear-off leaflets on the For The Record, Inc. Waldorf, Maryland (301) 870-8025 66
1 shelf wherever these products are, and I think in Sue's 2 video, there were some pictures of some flags on the 3 shelf to let the customers know that we have that 4 product on there with an EPC tag, and you can see here 5 an example of the leaflet on shelf, again, to let 6 customers know why we're doing this and that the product 7 has got an EPC tag on there, and they've got a choice. 8 They've got a choice then when they purchase that 9 product to remove that tag. We do not have any readers 10 on the sales floor. Our last read point, as you saw 11 there on the video, is as we exit the back room out onto 12 the sales floor. 13 And just to finish up, our consistent focus 14 going forward with our sellers and our suppliers is that 15 visibility of in-stock, driving increased sales, serving 16 our customers better, driving our currency, and we can 17 get equipment along with RFID equipment, that use of 18 equipment, how effectively are we using forklift trucks, 19 so on and so forth, but also cold chain compliance, I 20 think Dan touched on this area, that there will be in 21 the future tags available to monitor temperature. So, 22 again, we can ensure that products are fit for 23 consumption that have maintained chill compliance 24 through the supply chain, both driving for internal
25 efficiencies. For The Record, Inc. Waldorf, Maryland (301) 870-8025 67
1 This slide just really summarizes the benefits 2 which a lot of people touched on already about customer 3 in-stock, reduced inventory, theft prevention, lower 4 shrink in the supply chain, more efficient production 5 planning at the supplier, smart recalls and the dramatic 6 effect that can have, improved inventory control, and 7 then ultimately, less inventory counting at the DCs, 8 faster receiving of shipping, as I touched on at the 9 beginning, and overall improved quality inspection. 10 Thank you. 11 MR. HARWOOD: Thank you, Simon. 12 Next we have Bill Allen with TI. 13 MR. ALLEN: Good morning. It's a pleasure to be 14 here in Washington talking about my favorite subject, 15 which is radio frequency identification, and I'd like to 16 start off with a little bit of history of TI and our 17 presence in the market space. 18 Of course, TI, we claim to have a strong 19 heritage of innovation, perhaps the strongest. Mr. Jack 20 Kilby, one of our lower-level engineers, some 30 years 21 ago invented something that changed the course of 22 history, changed the course of the electronics age and 23 ushered in the electronics age, and in the year 2000 was 24 awarded a Nobel Prize for his efforts, and of course,
25 that was the invention of the integrated circuit. For The Record, Inc. Waldorf, Maryland (301) 870-8025 68
1 TI has been in this RFID space for 15 years now, 2 and we've surpassed the 300 million tag milestone just 3 recently, and we are active participants in standards 4 bodies around the world, ISO standards, IEC, ANSI, and 5 of course, now EPCglobal. In addition, TI RFID has 6 received a number of engineering excellence awards, 7 marketing innovation awards. 8 Some of the milestones recently that we have 9 surpassed, we've spoken about earlier, Dr. Engels talked 10 about the immobilizer technology that's used in Ford 11 products. In addition to that, if you drive a Jeep, 12 Chrysler, Mitsubishi, Toyota, Lexus, any time you start 13 your car, you're using RFID. You can't see it, but this 14 is a transponder that's inside the head of the key. 15 You're welcome to come out and look at the table, and we 16 have got some examples here. 17 This is the reader that's inside the steering 18 column. Now, they have a conversation, and they 19 authenticate each other to make sure that the driver and 20 the key is valid and you can drive away your car. 21 From there, actually the first application that 22 TI RFID was involved in was livestock tracking, and that 23 was driven by a problem, if you'll recall, some 15 years 24 ago or so, actually in western Europe, there was an
25 issue around mad cow disease, and identifying where that For The Record, Inc. Waldorf, Maryland (301) 870-8025 69
1 livestock was that had the disease was the important 2 thing, and being able to do that quickly and identify 3 them very quickly and accurately would enable them to 4 have less losses. 5 As you recall, millions upon millions of 6 livestock were slaughtered because they could not track 7 and trace where these livestock had been and what feed 8 lots they were at, et cetera, et cetera. So, it's a 9 wonderful implementation. 10 And of course, on December 23rd of this year, my 11 phone rang when our PR agency called and said, Bill, 12 there's a number of publications that would like to talk 13 to you about livestock tracking here in the U.S., and of 14 course, now it's on the radar screen of a number of 15 associations, including the USDA, for identifying 16 livestock. We had our first mad cow episode, if you'll 17 recall, December 23rd. I remember it well, because I 18 was on vacation. 19 Another application that was talked about a 20 little bit this morning was library books. 3M has 21 developed a wonderful implementation of RFID, and until 22 most recently, you will, in fact, be reading -- if you 23 keep up with RFID news, perhaps in the next week, there 24 will be a press release announcing the Vatican has
25 decided to use RFID to track books in their libraries For The Record, Inc. Waldorf, Maryland (301) 870-8025 70
1 and eventually some of the artifacts that are contained 2 within the Vatican museum. It's a wonderful 3 implementation of RFID. 4 And hopefully we have some ExxonMobil SpeedPass 5 users out there -- thank you, Lyle -- hopefully you have 6 this on your key ring. If not, go buy one -- or 7 actually, it's free. You can just sign up for one. And 8 7 million customers in the U.S. are using ExxonMobil's 9 SpeedPass to speed their way through the somewhat 10 inconvenient activity of filling your car up with gas, 11 and it's been also introduced in Japan, Singapore and a 12 facility in other markets around the world. Shell has 13 the implementation in Canada as well. 14 Marks & Spencer has been a long-time user of 15 RFID. They are currently using RFID to track 4 million 16 trays within their supply chain, and it's within their 17 chilled foods and fresh foods supply chain. They picked 18 up eight hours of store shelf life by speeding things 19 through the supply chain more quickly. They also 20 reduced their touch labor in managing these products, 21 reduced it by 80 percent, and their estimation was that 22 the ten-year cost of an RFID system that they 23 implemented would be one-tenth of the original bar code 24 solution that they implemented.
25 And here we are with a new innovation. Perhaps For The Record, Inc. Waldorf, Maryland (301) 870-8025 71
1 you've seen this commercial. All drivers recognize 2 their cars. Some cars recognize their drivers. This is 3 Smart Access, a feature introduced in Lexus models last 4 year or this year, and it actually identifies the driver 5 as the driver walks up to the automobile and 6 automatically opens the door or actually unlocks the 7 door, sets the seat, as Dr. Engels said, perhaps adjusts 8 the radio station, makes you a cup of coffee, whatever 9 you want. 10 Here are some other implementations. Of course, 11 we're talking about warehouse and supply chain 12 logistics. This is Bloemenveiling, which is the largest 13 flower auction in Holland. Bloemenveiling has to manage 14 100,000 carts of flowers, about a half a million trays 15 of flowers, and get this, they process 37,000 16 transactions per day, and it's all done with radio 17 frequency identification, and they have cut their order 18 processing by several hours, they have increased their 19 accuracy of order fulfillment to 99 percent, which was 20 their ultimate goal. 21 Product authentication, when a consumer goes out 22 to buy something, if it's a high-value brand, it's a 23 good thing that that's an authentic item, and RFID can 24 certainly be used to authenticate high-value or branded
25 type items. But in addition to that, there's a For The Record, Inc. Waldorf, Maryland (301) 870-8025 72
1 gentleman who plays professional football that I had the 2 pleasure of spending some time with recently. Did you 3 know that 60 percent of all sports memorabilia out there 4 is non-authentic? So, Mr. Emmet Smith was very 5 interested in using RFID to authenticate sports 6 memorabilia and is going to become globally involved in 7 this particular market. 8 Chip wafer manufacturing is another interesting 9 implementation, and yes, we do indeed, as someone told 10 me the other day, we do eat our own dog food. We 11 actually use the RFID tags to identify wafer trays as 12 they are processed, and it tracks what processes have 13 been performed and writes the information to the tag. 14 Some additional implementations. Test tube 15 tracking ensures the accuracy in tube identification, 16 and also, this is to protect patients, after all. Major 17 marathons was talked about, and my daughter ran the 18 Portland Marathon here recently. I was able to track 19 her progress through the race, for the whole time 20 essentially. 21 Of course, livestock, protecting food supply and 22 the quality of that food supply. Others, toll tags, I 23 can't live without mine. Every day I use it on my way 24 to work. It saves consumers time and also reduces
25 emissions, because there are less cars sitting in line For The Record, Inc. Waldorf, Maryland (301) 870-8025 73
1 trying to get through the toll booth. 2 Event access and ticketing is another major 3 implementation of RFID. If you go skiing in the Alps 4 this year, chances are you will use an RFID-enabled 5 ticket. Building access control, another very, very 6 popular implementation of RFID. 7 There's more. RFID keeps minors safe in Great 8 Britain. RFID keeps children safe at theme parks. RFID 9 keeps hospital patients from getting the wrong blood 10 type. It ensures that injured soldiers in Iraq get the 11 right medical procedures. Here's a wristband that's 12 used in this particular implementation. Tracking tree 13 growth patterns in the State of Washington; tracking 14 critical files in law offices; providing secure access 15 for the Academy Awards; and in tracking salmon migration 16 patterns, all kinds of many, many uses. 17 The state of the market? Well, RFID is not 18 emerging anymore. There are more than a billion 19 transponders deployed worldwide. RFID has been 20 delivering an ROI for many, many businesses for many, 21 many years. It's not something that's just come on the 22 scene. RFID has created new markets. It's benefitted 23 customers and consumers for many years. 24 When technologies come along, new technologies
25 present new opportunities. It requires us to ask the For The Record, Inc. Waldorf, Maryland (301) 870-8025 74
1 question, is there a better way to do something? It 2 presents an opportunity to rethink, redeploy and 3 re-engineer the entire enterprise. But for consumers, 4 it provides new conveniences. It provides more safety 5 and security. 6 So, let me get a few things straight finally. 7 There is no perfect frequency. They're all good. They 8 all have their own pluses and minuses, as was discussed 9 earlier. 10 Another thing to remember, RFID is not a cure 11 for bad business practices. If your supply chain is 12 fouled up, throwing a new technology at it is probably 13 just going to increase that. 14 The RFID industry has and will continue to 15 respond to concerns about the technology, and to get 16 this right, which we all have to do, it takes 17 collaboration between technology companies, industry 18 organizations, government agencies and end user and 19 consumer groups. 20 Who wins in this scenario? RFID will bring new 21 business opportunities and stimulate the high-tech 22 sector, according to most pundits. RFID will help 23 increase business profitability by having cost 24 reductions and inefficiencies within the supply chain,
25 and RFID, most importantly perhaps, will make the lives For The Record, Inc. Waldorf, Maryland (301) 870-8025 75
1 of consumers safer, more secure, easier and more 2 convenient. So, everybody is a winner. 3 Thank you. 4 MR. HARWOOD: All right. Well, thank you very 5 much, Bill, and next we have Ken Fishkin with Intel 6 Research in Seattle. 7 MR. FISHKIN: Good morning, everybody. It's a 8 pleasure to be here this morning. I'm going to be 9 talking about RFID particularly in the health care 10 industry, some of what people are doing now and then 11 some of the more speculative, longer-range things that 12 people are looking at in academia and research. 13 Health care is actually a pretty good monitor of 14 RFID. First of all, as we just heard, a lot of the 15 impetus for RFID or one of the big apps was the 16 livestock industry, and it sort of has this unexpected 17 benefit for health care, but for example, many RFID tags 18 are very robust to heat and grime. Some of Bill's tags, 19 for example, can survive sterilization and autoclaven, 20 which is very nice in the hospital domain. 21 RFID can be worked with no special user action, 22 you know, you're not doing this stuff. The fact that 23 there are a lot more bits in the tag in the health care 24 industry means that you cannot just say this is a bottle
25 of medication X, but you can say, this is that patient's For The Record, Inc. Waldorf, Maryland (301) 870-8025 76
1 bottle of medication X with this expiration date, and 2 they should take this many per day, they should not take 3 it with that, et cetera. You can pack all that 4 information in there. 5 And finally, because of the very high value 6 proposition in the supply chain as we've heard and we'll 7 hear more of later, cost is really just this huge 8 show-stopper, which may be true also here, because the 9 value proposition is so high. If you're going to keep 10 somebody from taking the wrong drugs, if you're going to 11 improve the health or stability of an elder, if you're 12 going to increase child safety, whether it costs you $40 13 or $50 worth of RFID tags is not going to be a 14 show-stopper. 15 Then there's another piece of technology that we 16 haven't heard much yet that is a nice match with health 17 care, which is a new wave of RFID readers. Most of the 18 applications -- actually, all of the applications you've 19 heard of so far use these dinner plate sized reader 20 antennas. In the petting zoo, they actually have some 21 of them out there that they're using, and the reason 22 that they use those is because they have this nice long 23 range, you know, couple of feet, couple of meters. 24 Well, if you're willing to give up on that range
25 and have an RFID reader with a range of like an inch, For The Record, Inc. Waldorf, Maryland (301) 870-8025 77
1 then you can have these very, very small readers, and 2 there's a picture of one you see there about the size of 3 a quarter. I saw one last week about the size of a 4 dime. So, those things -- and that's so small that you 5 can actually sort of fit them into some nice niches into 6 some health care scenarios, which I'll talk more about 7 in a couple slides. 8 So, then when we talk about some of the 9 applications domains in specific, so within a hospital 10 domain, probably the most common thing that's being done 11 right now is this really goods tracking, really supply 12 chain management, except now what you're tracking is 13 where is this piece of equipment? Where is the crash 14 cart? Where is this patient's chart? Where is this 15 doctor right now? I just read about a project they're 16 doing in Dallas with tagging the babies, to make sure 17 that the right baby goes with the right mother and that 18 nobody takes the baby out of the hospital. 19 Now, that's really conceptually, though, really 20 similar to the supply chain issue, except now you're 21 just tracking a different set of things. So, I'm not 22 going to talk about that much more. I'll talk a little 23 bit, though, about these scenarios involving these 24 really small readers.
25 These small readers are small enough that you For The Record, Inc. Waldorf, Maryland (301) 870-8025 78
1 can basically integrate them into high-value pieces of 2 hospital equipment, and they serve really as smart 3 connectors, to make sure that when you stick RFID tagged 4 object A into receptacle -- RFID reader receptacle B, 5 you did the right thing. People are talking about, as 6 we just heard from Bill, with blood bags, to make sure 7 you put the right blood into the right IV drips; with 8 anesthesiology, gas dispensing, make sure you plugged in 9 at the right time, et cetera. 10 There's another thing that we're actually about 11 to hear about, an FDA movement to require RFID tags on 12 pill bottles by 2007. So, one thing people have been 13 looking at in research is let's pretend it's 2008, what 14 can RFID do to help improve the quality of home health 15 care and medicine? This is a field that's actually been 16 entered by Accenture. This is a prototype that we get 17 from Seattle where one of the things you can do is you 18 can take these RFID readers, you combine them with a 19 digital scale, so now when somebody takes the pills, you 20 know not only that they took some pills, but how many 21 they took, and you're looking at the weight difference 22 when they put it back, and you can then integrate that 23 into a system, whether in the home or in the hospital, 24 that can do readings, reminders, prompts, it's time for
25 you to take this, you didn't take enough of that and so For The Record, Inc. Waldorf, Maryland (301) 870-8025 79
1 forth. 2 Now, a more speculative approach that we're 3 pursuing is to say, okay, now if we've got a bunch of 4 these objects getting tagged, if there are enough of 5 those objects around you in either the hospital or home 6 environment that are tagged, could we tell what you're 7 doing by looking at what tagged objects you're 8 interacting with at any particular time? This is 9 something we call the invisible man approach. If any of 10 you have ever seen invisible man movies, there are all 11 these scenes where there's an invisible man, so you 12 don't see him, but by what he's using, where he's using 13 it and the sequence he uses it in, you and the audience 14 all know what he's doing, that he's making a phone call, 15 he's brushing his teeth, he's having a cup of coffee. 16 So, the idea is that if we can detect 17 interactions with RFID-tagged objects, perhaps we can 18 help in this activity assessment, and I'll talk more 19 about how this could apply in two of these domains. 20 First, in the elder care domain, all right, 21 there's a case with elders with early stage kind of 22 decline where, for example, any nursing home that takes 23 Medicare funds has to fill out these so-called ADL 24 forms. ADL stands for activities of daily living or
25 things, as you see here, like using the phone, getting For The Record, Inc. Waldorf, Maryland (301) 870-8025 80
1 dressed, making a meal, taking care of a kid, et cetera, 2 and the caregivers have to fill out these forms, figure 3 out, you know, did you get dressed today, what did you 4 put on, how long did it take you. It's a very 5 time-consuming, invasive and error-prone process. 6 Well, if the elder is willing -- if we can 7 detect the elder's interactions with some of these 8 things, and now because we're in research we get to take 9 a look at things like this, the way we did this is we 10 took one of these small RFID readers, and we integrated 11 it with a glove, so as you pick things up, it knows it. 12 Well, obviously you couldn't ask an elder with early 13 stage common decline to do that, but a few years out, 14 this could be a bracelet. 15 Once you can do that, you can then at least give 16 this information to the caregiver to help them track and 17 assess how the elder's doing. This is actually one of 18 the very few cases I've heard of so far where RFID can 19 actually increase privacy in that it may not be all that 20 great to wear one of these bracelets, but first of all, 21 when you take it off, the data log stops, and secondly, 22 it may be better than having a caregiver go into the 23 bathroom with you or watch you get dressed, you know, at 24 least now there's a pair of eyes that are nowhere in the
25 room. For The Record, Inc. Waldorf, Maryland (301) 870-8025 81
1 We're doing a similar project along this line in 2 the hospital domain, more of the idea is to deal with 3 med school student grading and training. They have 4 these labs, these simulation labs, where these students 5 go through these procedures, and again, the doctors need 6 to take a lot of time and be in a lot of places to see 7 what the students are doing in the simulation. This 8 results in, for one thing, they're not doing the 9 simulations very often, because they don't have the time 10 for it, the doctor's time is vital, and secondly, again, 11 they miss things. 12 So, here's a case where you can actually ask the 13 med school students to wear gloves. So, they wear 14 gloves that look like this. They go do their 15 simulation, and they look at the data log and, again, 16 use that to help infer and assess how they're doing the 17 activities. This is a pilot project we're doing right 18 now at the University of Washington in the 19 Anesthesiology Department. 20 Since I'm here with a regulatory audience in 21 Washington, I would also say that for our next step, 22 we're trying to see if we can test this in the OR suite, 23 still with no real people, but in the OR suite. And 24 there are regulatory issues involving what RF
25 frequencies can be used with what power in an OR suite For The Record, Inc. Waldorf, Maryland (301) 870-8025 82
1 and then be able to be refined. So, if any of you out 2 there know what the answers are to those questions, 3 please see me. 4 Okay, so now let's see a video. So, now Intel 5 has made this lovely concept video showing some of the 6 things we're talking about now, again, a few years out, 7 where the form factor is a little bit nicer. The pad 8 you saw before is now actually the thing on the lower 9 right, this nice little stainless steel thing, and the 10 glove has been replaced by a bracelet. 11 So, I am going to have to do that -- pardon? 12 Yes, escape you, escape you, double click you. 13 (Videotape played for the workshop 14 participants.) 15 MR. FISHKIN: Hmm, hmm, hmm, I think I've 16 bottomed out on everything. So, I think I'll just end 17 the talk now. 18 MR. HARWOOD: Thank you, Ken, we appreciate the 19 presentation, and let's see, our next presenter is Paul 20 Rudolf, Paul Rudolf with the FDA. Dr. Rudolf? 21 DR. RUDOLF: Thank you very much. It's a 22 pleasure to be here. I was a member of the FDA 23 Counterfeit Drug Task Force last summer through the 24 spring. The task force no longer exists. The FDA
25 issued a report on counterfeit drugs, which you can all For The Record, Inc. Waldorf, Maryland (301) 870-8025 83
1 find on our Web site, www.fda.gov, if you would like to 2 find more information about our approach to counterfeit 3 drugs and in particular about RFID. 4 I'm going to talk a little bit initially about 5 counterfeit drugs and then talk about how we think RFID 6 can be used to combat counterfeit drugs. Last summer, 7 there were a whole slew of reports of counterfeit drugs 8 in the distribution chain. It was the thought of the 9 Commission and the rest of us at that time that 10 counterfeiting drugs was a particularly heinous crime, 11 much more so than counterfeiting clothes or sporting 12 goods or anything else, and that we needed to be very 13 proactive in combating counterfeit drugs, preventing 14 them from being introduced into the distribution chain, 15 and we thought it was a potentially huge public safety 16 issue. 17 Last summer and hopefully now, we thought that 18 the U.S. drug supply was the safest in the world. There 19 was a very small number of counterfeit drugs on the 20 market. In other countries, it's a huge problem. Up to 21 50 percent of drugs in some countries are thought to be 22 counterfeit. Some classes of drugs, such as 23 anti-malarials, certain vaccines and others, are known 24 to be counterfeit, and there are regular reports of
25 people dying of illnesses that can easily be prevented For The Record, Inc. Waldorf, Maryland (301) 870-8025 84
1 because the drugs are fake. 2 You hear a very little bit about the approach 3 that Nigeria is taking with counterfeit drugs. There's 4 a very active woman who's the head of their equivalent 5 of the FDA, and she's being very proactive, literally 6 closing down pharmacies who sell counterfeit drugs, 7 having bonfires burning counterfeit drugs. 8 Unfortunately, most other developing countries have not 9 been quite as aggressive. 10 We have noted at the FDA that there are at least 11 20 or 25 counterfeit drug investigations that are 12 opening every year, and that actually -- obviously, it 13 wasn't underscored, it minimizes the actual problem, 14 because each investigation usually involves hundreds of 15 people, hundreds of companies that are involved in these 16 schemes to introduce counterfeit drugs. 17 The counterfeiters in the world are becoming 18 increasingly sophisticated. They have access to a wide 19 range of very sophisticated technologies, so they can 20 very accurately reproduce the labeling, the packaging, 21 the bottles, the drugs, the pills themselves, with the 22 embossing, and it's really quite amazing to see some of 23 these pills that even experts can't distinguish from the 24 authentic products.
25 Now, of course, counterfeit drugs can be sold For The Record, Inc. Waldorf, Maryland (301) 870-8025 85
1 over the internet, can be imported into the United 2 States. So, we saw it as a huge potentially increasing 3 problem, and this is just a graphic with the number of 4 cases that we've opened. 5 So, with regard to the overall approach to 6 counterfeiting, we saw that there were about five places 7 in the drug distribution chain and the overall 8 marketplace that could be addressed to secure the U.S. 9 drug supply, and the first is the one that I talk about 10 today, securing the product in packaging. Clearly the 11 issue is about regulatory oversight, putting these 12 people in jail, reporting, educating consumers, all that 13 kind of stuff. 14 What we determined through our investigation, 15 through gathering information, is that the most 16 important thing to fight counterfeit drugs was the 17 establishment of a reliable pedigree, and that's been 18 talked about by some of the other speakers, the ability 19 to track and also trace in reverse logistics exactly 20 where a drug is going and where it's been, every single 21 custodian of the product. 22 At the end of that, the pharmacist can actually 23 look at a computer screen hopefully at some point and 24 look at the entire history of the drug bottle that just
25 arrived in his pharmacy and be very secure that that is For The Record, Inc. Waldorf, Maryland (301) 870-8025 86
1 an authentic product. We determined or we thought that 2 RFID could not only provide such a pedigree, but it's 3 probably the best way of providing that pedigree, and 4 it's the cornerstone of what we felt to be the fight 5 against counterfeit drugs in the United States and in 6 the world. 7 Now, in our report, we differentiated between 8 mass serialization, which is the unique number or the 9 EPC code which has been discussed and the actual 10 mechanism for reading that and associating information 11 with that number, which involves tags, readers and the 12 information infrastructure that you've all seen. 13 Obviously you've seen several tags, you've seen what the 14 code would be. 15 Now, many of you are probably not very familiar 16 with the way drug coding works now, but there's a code 17 that every drug has called an NDC code, which shows who 18 the manufacturer is, what kind of pill it is, is it 19 Lipitor, is it Viagra, the number of pills in the 20 bottle, a whole slew of information about the product. 21 It's not clear what will happen, but if there is an EPC 22 code associated with an individual bottle, it will 23 probably include the NDC number as well as other 24 information.
25 The reason why we differentiated mass For The Record, Inc. Waldorf, Maryland (301) 870-8025 87
1 serialization and the infrastructure used to associate 2 data with that code number is that two-dimensional bar 3 codes can also contain a unique number and can also be 4 scanned. We felt that RFID offered a large number of 5 advantages to 2D bar coding for serializing 6 pharmaceutical packages, cases, pallets; however, 2D bar 7 coding can be used, and right now, there's a lot of 8 discussion in the pharmaceutical industry about what's 9 the best near-term way of serializing all packages of 10 drugs. 11 Some drugs, as we talked about, as has been 12 talked about before, are very inexpensive. People have 13 talked about, well, why would you put a $5 or 5 cent 14 chip on something that's only worth 5 cents? Well, 15 there are generic drugs where a bottle of 100 might not 16 sell for more than a dollar or two, and there are issues 17 about whether RFID would be used on those bottles or 18 what the business case would be for that, and that's one 19 of the reasons why we have also thought that in some 20 cases 2D bar coding could be used for certain products. 21 With the publication of our report, we 22 established certain policies about RFID. The first was 23 that it was our policy to encourage as rapid adoption as 24 possible of RFID in the pharmaceutical supply chain, and
25 based on the information that we had obtained and in For The Record, Inc. Waldorf, Maryland (301) 870-8025 88
1 talking with folks at Wal-Mart, various manufacturers, 2 being involved with the Accenture project, we felt that 3 the widespread adoption of RFID in the pharmaceutical 4 supply chain was reasonable or feasible in 2007. 5 What that meant to us was that we felt that not 6 only could all cases and pallets be tagged with RFID 7 tags, but a large number of pharmaceutical bottles, 8 individual bottles, would also be tagged by 2007. That 9 doesn't mean every single drug. We know that there are 10 issues with certain types of drugs that would make it 11 harder to put tags on them -- liquid products are a good 12 example -- but we felt that the vast majority of drugs 13 could be tagged in 2007, and quite frankly, in being out 14 and speaking in various places and being in contact with 15 folks, I don't think that we have any notion of pulling 16 back from that right now. We think it's very feasible, 17 and we think it's very likely to happen. 18 We've heard an awful lot about some of the 19 drivers to RFID adoption. There are a couple within the 20 pharmaceutical industry that I wanted to mention with a 21 Florida pedigree law. There's a new law that was passed 22 in Florida, and I guess most people don't realize it, 23 but states regulate drug wholesalers, and drug 24 wholesalers have been a major conduit for the
25 introduction of counterfeit drugs, and the wholesalers For The Record, Inc. Waldorf, Maryland (301) 870-8025 89
1 basically handle the product between the time they leave 2 the manufacturer and the time they arrive in the 3 pharmacy, and some products go through one wholesaler, 4 some products can go through 10 or 20 wholesalers 5 depending on the price of the drug and what the 6 marketplace looks like on that particular day and week. 7 Because of current business practices in the 8 wholesaler industry, it's not that hard to introduce 9 fake or diverted product back into the supply chain, so 10 Florida passed a very stringent law which requires 11 pedigrees on all drug products by July of 2006, which 12 means that every bottle of drugs has to have a piece of 13 paper attached to it that says exactly where that drug 14 has been from the time it was manufactured to the time 15 it arrived at a pharmacy. 16 Well, as we all know, paper is very hard to deal 17 with, and you can imagine every package of drugs in the 18 State of Florida having a sheathe of papers associated 19 with it that people have to thumb through to figure out 20 where the drug has been is a pretty cumbersome process. 21 A lot of wholesalers have thought that they would be put 22 out of business, because they can't possibly manage all 23 that paper, especially big wholesalers. 24 I've been in some warehouses, McKesson and
25 Cardinal and AmeriSource, the three biggest drug For The Record, Inc. Waldorf, Maryland (301) 870-8025 90
1 wholesalers in the United States, and they fill 2 thousands of orders every day, and they have millions of 3 drugs coming in every day, and there's just no way that 4 they could process all that paper. So, the wholesale 5 industry has sort of grabbed onto RFID as a way of 6 complying with the Florida pedigree law and being able 7 to handle all the shipments they get and all the 8 shipments that they start and initiate to get to all the 9 pharmacies in Florida, and it's quite likely that other 10 states are going to pass very stringent pedigree laws as 11 well, and that's going to be a big driver in the 12 pharmaceutical industry for RFID, because wholesalers 13 are going to absolutely require RFID to do their 14 business. 15 The one other thing that was mentioned 16 previously that is particularly important in the 17 pharmaceutical supply chain are recalls. It's 18 critically important to do recalls as quickly and 19 efficiently as possible, and right now, it's a very 20 cumbersome, paper-driven process, and a lot of consumers 21 don't know whether they have a bottle of drugs that need 22 to be recalled or not. With RFID, you can literally 23 only recall those particular bottles which are at issue, 24 and you can do it literally within a day. You can save
25 millions of dollars, save a lot of people from being For The Record, Inc. Waldorf, Maryland (301) 870-8025 91
1 scared, and make sure that you recall the right bottles. 2 I'll skip this slide. 3 What we've done is we actually have made some 4 regulatory changes to try and facilitate RFID and help 5 focus the industry on using all the resources at its 6 disposal to adopt RFID. The PDMA, the Prescription Drug 7 Marketing Act, we made some changes with that to help 8 the industry out. We're working very closely with 9 sponsors and participants of pilot studies, notably with 10 RILA and Accenture, to identify regulatory issues which 11 could hinder the adoption of radio frequency technology. 12 Because we regulate the manufacture of drugs and 13 labeling of drugs, RFID poses a potential large number 14 of issues there. 15 One of the things that we decided we would not 16 do is we would not require RFID tags. We thought with 17 the industry changing as rapidly as it is, technology 18 advancing as rapidly as possible, that given the concern 19 of the pharmaceutical industry with compliance, that we 20 would probably stifle innovation if we required RFID, 21 because everyone would just stop and figure out how they 22 could comply with a regulation rather than continuing to 23 innovate and make things better. 24 What we're doing right now is we're watching a
25 whole slew of issues to make sure that they get dealt For The Record, Inc. Waldorf, Maryland (301) 870-8025 92
1 with and that folks also can comply with our expectation 2 in 2007. We're working on product quality issues. Does 3 the electromagnetic energy affect certain drug products, 4 where we know that some manufacturers are doing some 5 studies right now to make sure that that is not the 6 case. We've talked with industry about privacy issues. 7 That's not something that we would directly regulate or 8 be involved with, but we have the expectation that 9 industry will deal with privacy issues, such as killing 10 tags when consumers purchase drugs. 11 One other thing that we're interested in which I 12 thought I would mention is the potential to use tags to 13 provide information to patients. Now, this obviously is 14 a two-edged sword. As was mentioned earlier, it's a 15 huge potential conduit to give useful information to 16 patients at the time they purchase drugs because of the 17 product information that can be associated with the drug 18 product. Obviously pharmacists would get that same 19 information. 20 On the other hand, it's also potentially a way 21 of advertising other drugs, advertising things which 22 were not normally allowed to be advertised, and talking 23 about off-label uses, because you can imagine that when 24 you read a number, not only the good information about a
25 drug comes up, but also, you know, manufacturers and For The Record, Inc. Waldorf, Maryland (301) 870-8025 93
1 wholesalers can put ads in the database. They can put 2 other types of information in there, and so there's a 3 whole series of issues like that that we're concerned 4 about that we're going to have to think about as RFID 5 gets more widespread. 6 The last thing I want to mention are database 7 issues. Those were touched upon before, but in the 8 pharmaceutical industry, they're really extremely 9 important. Is the database that people are going to 10 have access to a distributed database where every 11 participant in the supply chain has limited access to a 12 small amount of information about the product, or is it 13 going to be a centralized database and everyone has 14 access to a lot more information? In the pharmaceutical 15 industry, that's yet to be worked out, and that may be 16 one thing that could delay the adoption of RFID. 17 Then the last thing that I want to mention 18 before I finish is that clearly RFID is not the end-all, 19 be-all. It's going to require people to actually use 20 it, and it's going to require some amount of due 21 diligence, and one of the things that clearly is going 22 to need to happen at some point is in the pharmaceutical 23 industry, if you purchase and sell drugs, you need to 24 only do business with people who are RFID-enabled and
25 use RFID. For The Record, Inc. Waldorf, Maryland (301) 870-8025 94
1 A drug, even with RFID, a drug could clearly go 2 to a wholesaler where there's no RFID, so it's not 3 scanned in or scanned out, it's just in a huge hole for 4 two or three days, who knows what might happen to that 5 bottle, and then it gets shipped to another wholesaler 6 who is RFID-enabled, and unless someone catches the fact 7 that it took longer than it should have to get from this 8 wholesaler to this one and think that maybe there is 9 something going on in between, you know, you can't catch 10 that. 11 Now, there are ways of knowing whether bottles 12 have been tampered with. You can put the tags 13 underneath the cap and put sealers around them, but 14 people who are pretty smart can probably figure out a 15 way to put fake pills in a bottle that has an RFID tag 16 on it. So, one of the things that we're going to be 17 looking at in the pharmaceutical supply chain is are all 18 the participants only doing business with other people 19 who use RFID. 20 With that, I will conclude. 21 MR. HARWOOD: All right, thank you, Dr. Rudolf. 22 We appreciate your presentation. 23 Next we have Lee Tien who is with the Electronic 24 Frontier Foundation.
25 MR. TIEN: Hi there. I'm going to sort of sound For The Record, Inc. Waldorf, Maryland (301) 870-8025 95
1 the cautionary note about the privacy implications of 2 RFID, but it's not going to be a really privacy-oriented 3 discussion, because I think a lot of what we're going to 4 be talking about later this afternoon will focus on what 5 are the privacy issues. So, what I want to do today in 6 my time is talk about how government RFID use and 7 government-mandated RFID use is sort of a distinct 8 problem from the retail RFID privacy issue. 9 It's fairly obvious that government is moving 10 into RFID in a very big way. I have got a handout 11 outside that lists a lot of the current and contemplated 12 government uses. We can start with DoD's mandate in 13 October 2003 requiring all of its suppliers to use RFIDs 14 by January 2005. This is going to be a big potential 15 driver for item-level tagging. 16 The Homeland Security Department, from what we 17 can tell, is already using RFIDs in its U.S.-Canada 18 nexus, latest traveler card, and is talking about using 19 RFIDs in boarding passes. Obviously as people have 20 talked about, there are a lot of transportation sector 21 uses. This is an obvious one because of the economics 22 of transportation, the toll cards, the use of RFID 23 devices makes sense there from an economic standpoint. 24 Money, the European Union has been looking at
25 putting RFIDs into currency. We heard at one workshop For The Record, Inc. Waldorf, Maryland (301) 870-8025 96
1 even within the last couple of months that there is 2 actually a country in the world right now that has 3 already embedded RFIDs into their currency, but I don't 4 know which country that is. The Treasury Department is 5 apparently looking at RFIDs in currency as an 6 anti-counterfeiting device. 7 Schools, you know, this is something that we're 8 hearing about a lot, that at a very low sort of grass 9 roots level, people are looking at using RFIDs to 10 essentially track students. There's a charter school in 11 New York that's begun to record the time of day students 12 arrive in the morning using RFID tags, and they want to 13 use them to track library loans, disciplinary records, 14 cafeteria purchases, visits to the nurse's office and so 15 on. 16 So, what is special or different about 17 government RFID or RFID-mandated uses? Well, one aspect 18 of it is not special, but I think it's worth 19 highlighting. Of course, it's the promiscuousness of 20 the RFIDs in general. A lot of what we are concerned 21 about in the privacy world does not manifest nearly as 22 much if the RFIDs are not promiscuous; that is, there's 23 security, cryptographic access controls and so on, but 24 we're not expecting that to be seen in a lot of the
25 kinds of applications we're looking at, such as in the For The Record, Inc. Waldorf, Maryland (301) 870-8025 97
1 pharmaceutical area. 2 The second is a certain degree of persistence; 3 that is, we expect that RFID applications in the 4 government sector will not be intended or in the context 5 where we would necessarily kill them when we get the 6 device. The obvious example would be when RFIDs are 7 used or if RFIDs are used in, say, driver's licenses, 8 other kinds of ID documents, it's unlikely, given what 9 the Government would intend to use such devices for, 10 they would say, oh, yeah, go ahead and kill it. 11 The third is their pervasiveness. If schools, 12 Post Offices, money, public transit, et cetera, et 13 cetera, are going to be all using RFIDs, then we should 14 expect to see a fairly interoperable and pervasive 15 network of RFID sensors, and that should be something 16 that we ought to be concerned about from the privacy 17 standpoint. 18 Now, another government use example that EFF has 19 been very engaged in has been in the use of RFIDs for 20 tracking and tagging library books. We're based in San 21 Francisco, and the San Francisco Public Library, like 22 many other libraries across the country, are looking at 23 using RFIDs for item-level tagging of all borrowed 24 materials. Now, this has obvious advantages for the
25 library from a supply chain standpoint, but it has For The Record, Inc. Waldorf, Maryland (301) 870-8025 98
1 concerns for privacy. 2 The obvious question of associating people's 3 identity with the content or preferences that they have 4 in terms of what they read, you know, is a traditional 5 sort of reading privacy issue, and it has that 6 persistence issue, which is that you wouldn't want 7 people who were using this system for their tag to be 8 killed when the first patron, you know, borrows the 9 item. The whole point is that it's going to be coming 10 back. So, how do you deal with that problem? 11 This is something that a number of the privacy 12 groups have been trying to dialogue with the libraries 13 about. I'm hoping, actually, in San Francisco to stop 14 them from adopting RFIDs at all, because we've seen no 15 indication that they have a clear understanding of the 16 privacy issues or a commitment to using privacy 17 safeguards there. 18 But I don't want to focus too much on the 19 privacy aspects of that. There are two other issues 20 that end up coming out of this from EFF's perspective. 21 The first is a question of governance, and we're seeing 22 essentially agencies as small as the local public 23 library or a charter school to as large as the Defense 24 Department with 43,000 suppliers and somewhere in the
25 neighborhood of 45 million separate line items all For The Record, Inc. Waldorf, Maryland (301) 870-8025 99
1 talking or actually adopting RFID. 2 But where's the public governance as far as 3 these kinds of adoptions go? Where is the public 4 deliberative process in terms of fact-gathering, a 5 privacy impact analysis or assessments, technology 6 assessments? From a privacy standpoint, I do not want 7 to see, you know, my state DMV or my child's public 8 school being able to decide, well, we got a good deal 9 from an RFID vendor, we are going to start tagging all 10 the kids. I think there's a real need for a large-scale 11 public deliberative process to govern government use of 12 RFID. 13 The second point, of course, is that government 14 use can't be separated from private sector use from a 15 privacy policy perspective. We have to have a unified 16 approach. And the first most obvious reason, of course, 17 is that you have a spillover or subsidy effect from 18 government use into the private sector. 19 Now, most privacy-endangering technologies like 20 RFIDs can be analyzed in terms of market failure. Think 21 about pollution. It might be individually rational for 22 a company to pollute because the costs of pollution are 23 distributed across society, but it is not necessarily 24 socially or collectively rational for that individual
25 firm to actually do so, because if everyone follows that For The Record, Inc. Waldorf, Maryland (301) 870-8025 100
1 same thing, you end up with lower air quality or water 2 quality. 3 We think that in the privacy area, RFIDs 4 represent a form of privacy pollution, and we need to do 5 something to think about how we control the polluting 6 effects, and this is something that government would be 7 contributing to if government continues to adopt RFIDs. 8 Certainly whatever Wal-Mart does, the impact of the 9 Defense Department, of Postal Services, of schools, of 10 all of these government entities deciding that, yes, we 11 should be using RFIDs is going to, you know, radically 12 affect the demand for RFIDs and spread their deployment 13 much faster than otherwise would have been. 14 And then beyond just sort of these economic 15 effects, there is the legitimation effect; that is, if 16 your friendly neighborhood library is using RFIDs, how 17 bad can they be? If we have all of these sort of 18 supposedly beneficial or actually beneficial 19 applications of RFID, questions of when do we do 20 anything about the data privacy and tracking issues 21 associated with RFIDs will fade, will be left behind. 22 So, I have a few specific recommendations to go 23 along with this critique. The first is that we should 24 have specific legislative authorization with meaningful
25 privacy safeguards and not merely appropriations or For The Record, Inc. Waldorf, Maryland (301) 870-8025 101
1 agency-level processes before governments use RFID. 2 RFID should not be used by governments, at least not 3 promiscuous ones, to eliminate anonymity, and that 4 counsels against the use in driver's licenses, 5 passports, ID cards and such. 6 You should not allow law enforcement, in 7 general, to track people using RFIDs without meeting 8 Constitutionally stringent privacy safeguards. And 9 finally, we need to really consider whether or not 10 public entities -- in fact, I would say public entities 11 should not be allowed to gather information from private 12 sector RFIDs and vice versa, again, without stringent 13 Constitutional safeguards. 14 Thanks. 15 MR. HARWOOD: All right, thank you, Lee. Let's 16 see, before our final speaker, Peter Sand, I wanted to 17 remind you that if you have questions you would like us 18 to ask the panelists, you can go ahead and fill out one 19 of these cards that look like this, and they're in your 20 packet, and if you wave them around, our faithful 21 assistant in the back, Grant, will pick them up from you 22 and bring them up front. 23 Okay, with that, Peter Sand, do you want to go 24 ahead -- our final panelist here, then.
25 MR. SAND: Thank you, thank you very much. For The Record, Inc. Waldorf, Maryland (301) 870-8025 102
1 My name is Peter Sand, and I am the Director of 2 Privacy Technology within the Privacy Office of the 3 Department of Homeland Security, which means I'm 4 basically a human bridge between the people managing the 5 technology and the people managing privacy issues, and I 6 spend a lot of my time kind of shuttling information 7 back and forth to make sure that the technology people 8 understand the basic principles of privacy, and the 9 privacy people understand the details of the technology 10 that's implied. 11 I'm going to talk a little bit about the role of 12 the Privacy Office within the Department of Homeland 13 Security and then just go through a couple of quick 14 examples to give you a flavor for the kind of work that 15 we end up doing. 16 There are three basic measures that can be used 17 to assess the value of any new technology. The first 18 is, does it advance the organization's goal? The second 19 is, does it make the experience of using that technology 20 better for everybody involved? And finally, does that 21 new technology sustain privacy protections? 22 At the Department of Homeland Security, we 23 address that third measurement with the Privacy Office 24 led by the Chief Privacy Officer for the Department,
25 Nuala O'Connor Kelly. In fact, the mission of the For The Record, Inc. Waldorf, Maryland (301) 870-8025 103
1 Privacy Office is to ensure that as the Department 2 pursues its mission to secure the homeland, that it does 3 so without invading privacy. 4 The Privacy Office is organized along lines of 5 disciplines. There's an international focus. There's a 6 disclosure focus, which is basically Freedom of 7 Information Act responses, and there's a compliance 8 focus and a technology focus. 9 Within the technology area, the Privacy Office 10 seeks to operationalize privacy, which means to build 11 privacy protections into the actual system development 12 process so that privacy issues are raised and addressed 13 as the technology matures, rather than leaving privacy 14 as a final box on a long checklist of technology issues. 15 This way, we can ensure that all privacy issues are 16 addressed as the technology develops from beginning to 17 end. 18 At the same time, the Privacy Office is an 19 independent office serving advisory and oversight roles 20 within the Department. The Chief Privacy Officer 21 reports directly to the Secretary and also separately to 22 Congress to report on how the Department's use of 23 technology and operations affect privacy protections. 24 The key to understanding any need for
25 information technology is the information itself. New For The Record, Inc. Waldorf, Maryland (301) 870-8025 104
1 information drives everything. It drives the 2 technology, and it also drives the privacy assessment. 3 When information is personal information, meaning it 4 identifies a person individually, the Privacy Office 5 adds into the regular development process an additional 6 step of public notice. 7 The Privacy Office works with the folks that are 8 evaluating and building new technology to identify any 9 potential privacy impacts which may be raised by that 10 department, and we do that by asking a long list of 11 questions, things such as, what information is being 12 collected? Why is it being collected? Where does the 13 information come from? How will it be secured? How 14 will it be checked for accuracy? If there is an 15 inaccuracy, how do people go about correcting those? 16 Who will have access to the information? How will that 17 access be managed? And the questions go on and on and 18 on. 19 We work with the actual developers to build 20 answers to these questions so that as the technology 21 matures and is used more within the Department, those 22 issues are raised and developed at the same time, and 23 all that information is published directly to the 24 public. This fosters openness and transparency
25 regarding how the Government uses personal information, For The Record, Inc. Waldorf, Maryland (301) 870-8025 105
1 and it ensures that when the Government, our Department, 2 finds a new technology that advances the organization's 3 goals and also improves the experience, that that use of 4 technology also sustains privacy protections. 5 And this process is repeated over and over and 6 over again. As a particular implementation of 7 technology changes, as a system is upgraded or as new 8 things are added to it, we repeat that process again so 9 that the public is notified as things change about the 10 implications of those changes. 11 I want to talk about two very quick examples. 12 The first is tracking baggage through the airport 13 system. These are things that the Department is looking 14 at. These are not things that have been finalized or 15 implemented. They're just avenues of pursuit within the 16 Department. 17 In terms of tracking baggage, the purpose is to 18 facilitate travel, to make sure that the bags go where 19 they're supposed to go and actually get there and get 20 there as quickly as possible. There are two issues that 21 are raised. The first is an issue of scope. You want 22 to make sure that when that job of tracking baggage is 23 done, that the technology that tracks information 24 related to that bag ends, that there's no continued
25 broadcast of that information. The second issue is For The Record, Inc. Waldorf, Maryland (301) 870-8025 106
1 education, so that as a process like that is rolled out, 2 people understand what it is, how it works, what the 3 implications are and what kind of access they have to 4 the process itself. 5 The second quick example is border crossing. 6 Again, the goal using the technology there is to 7 facilitate travel. There's something like 330 million 8 actual crossings of borders a year, and the goal is to 9 get the appropriate level of information to the right 10 people at the right time so that they can inform 11 decisions in terms of facilitating that crossing. 12 The goal is to make that process work as quickly 13 as possible, hopefully faster than the current process 14 is now, and some of the issues that are raised are how 15 much information actually needs to be transferred during 16 that crossing. Can you use just a simple number that 17 would trigger a record in a database that will present 18 information to a screen rather than actually 19 broadcasting the information that relates to that person 20 directly? 21 And then another issue is control. Is there a 22 way to use technology to give the individual person 23 control over when information is broadcast, and is there 24 a button that you could put on something that the person
25 would say, okay, now that I'm here, I am going to send For The Record, Inc. Waldorf, Maryland (301) 870-8025 107
1 you my information, and not have it be an automated, 2 ongoing process? 3 That's a very, very quick review of what's 4 happening in the Department of Homeland Security 5 specifically with privacy. Thank you very much for your 6 time, and I understand lunch is soon, so... 7 MR. HARWOOD: All right, well, thank you, Peter. 8 All right, next we have got some questions, and 9 Lyle, should we start with the cards or do you want to 10 ask a few first? 11 MR. GINSBURG: As much as I relish the 12 opportunity to torture my panelists here, I do travel in 13 the same circles with some of these folks, so I think 14 we'd rather get to your questions first, but I'll save 15 some of mine for afterwards. 16 Paul -- and please make sure you speak into the 17 mic, if you can -- how can we stop fake pedigree 18 information being generated by counterfeiters? 19 MR. RUDOLF: Well, there's several ways to do 20 that, and some of them are fully technical and maybe 21 some other people on the panel would know better than I 22 do, but aside from limiting access to database, if a 23 counterfeiter had the money to actually -- had a foundry 24 to produce fake tags, the tags all have an actual
25 foundry number on them in addition to an EPC number. For The Record, Inc. Waldorf, Maryland (301) 870-8025 108
1 So, there's one protection there. 2 If you know that Pfizer has purchased all their 3 drugs from one manufacturer, you'll know that the tag 4 might have a different foundry number on it, and you'd 5 know that it wasn't really a drug purchased by Pfizer. 6 Plus, each company will have a whole list of EPC numbers 7 which are active, and so what a counterfeiter would have 8 to do is they would have to hack into a database to know 9 which numbers were active for which drugs, and then they 10 also have to duplicate the pedigree information, because 11 an unauthorized person wouldn't have access to the 12 associated data. 13 So, you have the foundry number, you have the 14 potential for the need to hack into the database to know 15 which numbers are active, and then you have to duplicate 16 the pedigree information, and even then what would 17 happen is the bottle would show up in the system as a 18 duplicate. So, theoretically, the worst thing that 19 would happen is that both bottles with the same EPC 20 number would be located hopefully very quickly and be 21 tossed out of the system, because you might not know 22 which one was counterfeit if the counterfeiter was able 23 to produce the right pedigree. 24 So, you've got a whole slew of protections, and
25 then you have a minimal effect on the end in terms of For The Record, Inc. Waldorf, Maryland (301) 870-8025 109
1 when bottles are affected and thrown out. 2 MR. GINSBURG: Okay. Simon, why did Wal-Mart 3 conduct an item-level tagging pilot -- question, Broken 4 Arrow -- especially if it isn't currently using RFID at 5 the item level? 6 MR. LANGFORD: As a lot of people know, we've 7 conducted some field trial tests with the Auto-ID Center 8 since about 2000. We started at the pallet level, case 9 level and then started to look at item level, but it 10 very soon came to light that pallet and case was the 11 area to focus on, where the real benefits were in the 12 short term, medium term, and so that pilot didn't go any 13 further. 14 MR. WOOD: Real quick, and that really has been 15 the findings. As I talked about, the economics behind 16 item-level just doesn't make sense right now for 17 retailers to implement. So, we think the tests have 18 occurred, and there probably may be a few more retailers 19 who test, but ultimately, the realization is that the 20 real benefit exists in the supply chain, and that's 21 really where significant dollars can be saved, and I 22 think that's where you'll see implementation within the 23 retail industry. 24 MR. GINSBURG: Okay. Lee, there was a claim
25 that tagging library books with RFID is For The Record, Inc. Waldorf, Maryland (301) 870-8025 110
1 privacy-invasive, but given that libraries already track 2 who checks out what books, what does RFID add that is a 3 privacy concern? 4 MR. TIEN: Well, the main one is if the RFID 5 tags are not secure, i.e., they are promiscuous, then 6 unlike a situation where only the library knows what the 7 book is, anyone with a compatible scanner or reader 8 would be able to get that information, and so the 9 audience for the information is no longer simply 10 internal to the library, but it could be anyone who can 11 read it, and you know, this is a concern not only 12 because of libraries themselves tagging but because the 13 publishing industry is looking into the use of RFID tags 14 for books generally. 15 So, you have sort of an issue of information and 16 materials that are very regulatory of what people are 17 thinking being capable of being associated covertly and 18 at a distance with their identities. 19 MR. GINSBURG: Thank you. For Peter, border 20 crossing, what would be tagged? Does this include 21 passports with RFID tags, and if yes, where are we now 22 with regards to RFID-enabled passports? 23 MR. SAND: My understanding is that it would 24 just be an additional step in the identification cards
25 that people currently use now. Right now, the actual For The Record, Inc. Waldorf, Maryland (301) 870-8025 111
1 transaction is very manual, very kind of human-oriented, 2 and the idea would be to take information that already 3 exists and just facilitate that communication better. 4 It's already taking place now. It's just a question of 5 using technology to make it work a little faster, a 6 little better. 7 MR. GINSBURG: Thank you. I'm going to throw 8 out one of my zingers here. Britt, a fascinating pie 9 chart with the costs, you know, as you said, everybody 10 is so fixated on hardware costs, tag costs, reader costs 11 and all that, yet you listed 3 percent of the cost of 12 implementation as hardware, 73 percent software. 13 All right, simple math, using your sort of 14 average of tag costs, 30 cents a tag, someone has 50 15 million cases a year that they send to Wal-Mart, that's 16 a big number, and if that's 3 percent of the total 17 costs, this thing is going to be enormous. 18 So, how do we rationalize the ratios? 19 MR. WOOD: You rationalize the ratios based on 20 the fact that the percentage of software is based on the 21 life of the project. In other words, there will be 22 different iterations of chips, different iterations of 23 numbers, and therefore, you are going to have to 24 continually upgrade your software.
25 We have had discussions with different retailers For The Record, Inc. Waldorf, Maryland (301) 870-8025 112
1 that have kind of talked about the fact that once we can 2 get the readers right and the chips to a basic level, 3 then it really is just kind of working with the software 4 and doing upgrades. So, in the lifetime of a project, 5 you will be looking at extensive costs in the software 6 side of the business. Up front, the costs really 7 resonate on the chip and hardware side. 8 MR. GINSBURG: Thank you, thank you. 9 Bill, one of the more sort of upstart, let's 10 call them pure play RFID companies that got a lot of 11 attention so far in relation to this CPG retail 12 phenomenon that's taking place now, more so than all the 13 other areas that you talked about, yet TI is still 14 beginning to write in a big way. What impact do you 15 think TI can have on this issue of cost? You're much 16 bigger than any of those other smaller companies that 17 are in here. 18 I know Philips was up here earlier, and we 19 should ask the same question of Philips, but 20 representing one of the big guys, what do you think we 21 can expect to see in terms of TI's impact on that 22 market? 23 MR. ALLEN: Well, thanks. As a chip 24 manufacturer and one of the major chip manufacturers in
25 the world, we already make billions of things per year, For The Record, Inc. Waldorf, Maryland (301) 870-8025 113
1 and we are also working on expanded wafer technology, 2 going to a larger wafer in order to get yield higher, 3 and by doing a number of things like that, we feel like 4 and the math looks so far, it does look like we can 5 reduce costs down to a level where we can achieve that 6 Holy Grail that's always been there of a 5 cent tag, and 7 I think it's using economies of scale and, of course, as 8 volume ramps up, we can produce more, reduce prices, and 9 I am confident that we can deliver that. 10 MR. GINSBURG: So, of course, I have to ask the 11 follow-up question. When? 12 MR. ALLEN: When? Well, as soon as you guys 13 give us lots and lots of POs. 14 MR. GINSBURG: Okay, fair enough, fair enough. 15 Okay, Paul, back to you. How do you plan to 16 balance the FDA's refusal to create regulations on RFID, 17 per your final comment, and against your final comment 18 that the FDA will require manufacturers to only work 19 with wholesalers who use RFID? 20 MR. RUDOLF: Well, if I used the word "require," 21 I misspoke. The FDA can't require that people do 22 business with each other, so if I said that, I 23 apologize. 24 What we've been doing is working with industry
25 to try and get industry to adopt internal good business For The Record, Inc. Waldorf, Maryland (301) 870-8025 114
1 practices, and in fact, the Healthcare Distribution 2 Management Association has a set of business practices 3 that they have posted on their Web site for wholesalers. 4 A lot of manufacturers have adopted business practices 5 that limit sales to certain wholesalers that might use 6 certain criteria, and I think that's one of the things 7 that we'll at least discuss with various industry 8 participants, is how could that happen. We would not 9 require -- we can't require that. 10 And with regard to not requiring RFID, we 11 actually think the industry will adopt RFID more quickly 12 if we don't require it. 13 MR. GINSBURG: Okay, Chuck. 14 MR. HARWOOD: Yeah, let me ask a question of 15 Ken. 16 Ken, a lot of the applications -- to, say, get 17 the data, scan the items, Ken, a lot of the applications 18 you talked about seemed to involve the use of 19 tremendously small RFID chips. I wonder if you have a 20 sense of, you know, how close we are to actually having 21 the chips that are small enough to be usable in sort of 22 the applications you described, the home or hospital 23 applications. 24 MR. FISHKIN: Well, it depends on -- you mean
25 the tags or the readers? For The Record, Inc. Waldorf, Maryland (301) 870-8025 115
1 MR. HARWOOD: Actually I meant the tags, but if 2 you want to address both of them, that would be good. 3 Actually, the readers, too, I meant the readers as well. 4 MR. FISHKIN: Well, okay. On the reader side, 5 as I showed, there are readers out there, you know, 6 today, pretty new on the market, but there are readers 7 today that are really very small. Like I said, there's 8 one from a company called Innovision which is basically 9 the size of a dime. Now, you have to add things to 10 that. You add the battery supply, you need to add the 11 wireless communication, you need to add the antenna, et 12 cetera, but still, the overall package, like I said, 13 today can really be pretty darn small, you know, they're 14 putting them in a Nokia cell phone. So, on that, I 15 think, you know, we're pretty much there. 16 On the tag front, again, even though I'm from 17 Intel, we're not making these chips, we're just buying 18 them from people like Bill, and the tags they have today 19 are kind of awkward. They're a bit big, but the vast 20 majority of the real estate is actually antenna. The 21 chip itself is really small. So, it really becomes a 22 function of sort of what read range you want, how robust 23 you want the reads to be, you know, so do you have to, 24 you know, hit it just right.
25 So, for example, in the anesthesiology thing For The Record, Inc. Waldorf, Maryland (301) 870-8025 116
1 which we're doing now, and there again, we literally 2 wheeled an anesthesiology cart into our lab and started 3 tagging the stuff that they use today, and it's a 4 problem on some of the things, but not by much and not 5 by many. The best ones we have are actually -- in fact, 6 the best ones we have are ones from TI which are about 7 the size of a quarter, and then there are some from 8 Alien which are about the size of like a pinky finger, 9 and so it would be nice if they were smaller, but those 10 are good enough to get you most things. 11 The bigger issue we have is something that I 12 touched on briefly earlier, which -- in fact, this is 13 the exact type we use, thank you, so-called laundry 14 tags. The bigger issue is, at least in this 15 environment, we have a lot of stuff that's metal, and 16 these things really don't like being near metal, and 17 that's really a more severe problem, and that I think 18 would require more work. 19 MR. HARWOOD: Thank you. 20 Peter, does DHS intend to provide technology 21 companies liability protection with regards to privacy 22 matters similar to the Safety Act which protects 23 companies from legal liability for developing 24 technologies to combat terrorism?
25 MR. SAND: I have not been part of any For The Record, Inc. Waldorf, Maryland (301) 870-8025 117
1 discussion about liability protection from DHS. I think 2 what's more likely is that there would be a long series 3 of open forums of discussion, so that people can put out 4 in public what they see the issues to be and then design 5 from the best ideas that come out of those discussions, 6 so that a lot of the issues are resolved ahead of time. 7 That I think would be the most efficient way to resolve 8 those kind of issues. 9 MR. GINSBURG: Maybe for Bill and Ken, is an 10 interconnected public network of readers truly possible 11 to read all RFID tags? How would you manage the 12 terabytes of data? 13 MR. FISHKIN: Well, how long do we have? Let me 14 get to the first part of that, and then actually people 15 like Jim Waldo would actually be much better to answer 16 the second part of that, and he's on a panel this 17 afternoon, so maybe I'll defer some of that. 18 Interoperability is a problem. There are 19 multiple frequencies which are mutually incompatible, 20 but it's getting better. The number of frequencies is 21 going down, particularly driven by people like Wal-Mart. 22 Standards are emerging, the EPC standards, things like 23 that. So, it's getting better. 24 There are readers, though, today that can read
25 two or three of these, which gets you most of them. So, For The Record, Inc. Waldorf, Maryland (301) 870-8025 118
1 I think from sort of a technical engineering point of 2 view, it's doable, and it will become more doable within 3 a few years. 4 As far as the data access, I think I will 5 happily save that for maybe later in the day, unless, 6 Bill, you want to address that. 7 MR. ALLEN: Well, on the multi-protocol reader 8 side of things, when you put that requirement in, 9 performance is degraded, because it has to frequency-hop 10 and do a variety of different things. So, there's 11 tradeoffs for anything that you do no matter what 12 technology you're applying. If you want it to work 13 harder, performance will be degraded. 14 And then on the data side, yes, that's a very 15 daunting question, is what are we going to do with all 16 this data? And of course, a friend of mine who works as 17 an analyst in the retail sector did his own little 18 calculation one night when I guess he couldn't sleep and 19 wanted something to do to occupy his time, and so, 20 Simon, he calculated about how much data Wal-Mart would 21 generate in one day, and I don't remember all of the 22 details of it, but it was something like if you guys 23 read, you know, so many tags in so many stores, it would 24 generally 7.6 million terabytes of data per day.
25 Obviously that's a fairly daunting number, but For The Record, Inc. Waldorf, Maryland (301) 870-8025 119
1 again, there will be solutions that come along, because, 2 you know, you can have a savant server that says, do I 3 need this data? No. Okay, I ignore it. Do I need this 4 data? No, I ignore it. Did something change? Yes, I 5 need this data. Therefore, I'll write that data. So, 6 there will be schemes that will be developed in order to 7 reduce the amount of data that is generated by RFID. 8 MR. GINSBURG: Simon, any thoughts on how much 9 data you're going to be -- 10 MR. LANGFORD: I think the last comment there is 11 the crucial one, is keeping the data or acting on the 12 data that you need to, the fact that a tag may go past a 13 reader 30 or 40 times in this room, but I don't care 14 about that. What I care about is when it leaves the 15 distribution center and arrives in the store. We keep 16 all of the data now on movements of merchandise through 17 our supply chain. At least the RFID is plugging some of 18 those holes, or as I intimated earlier, knowing when a 19 case moves out to the sales floor, where is it? Is it 20 in the back room or the sales floor? So we can direct 21 associates to go and find that product in the back room. 22 So, it's just taking those extra read points and acting 23 upon that to help our associates serve our customers 24 better and more efficiently.
25 MR. GINSBURG: Well, while you've got the mike, For The Record, Inc. Waldorf, Maryland (301) 870-8025 120
1 we've got a series of retail questions lined up here, 2 some for you and maybe Britt can help you out here a 3 little bit. 4 One specifically for you is does Wal-Mart have 5 an estimate of when all Wal-Mart DCs and retail back 6 rooms will have RFID readers? 7 MR. LANGFORD: We're currently working with our 8 suppliers. We've recently announced last week our 9 expansion through the next year, where we'll be in 10 something like about a dozen distribution centers and up 11 to 600 stores by the end of 2005, for January 2006. 12 We're working with our suppliers on that expansion plan 13 to get their feedback and expectations of theirs. 14 MR. GINSBURG: For you and Britt, if RFID tags 15 permit larger numbers of items in stores with fewer 16 stock-outs, will retailers reduce shelf facings and/or 17 slotting allowances as adoption becomes more widespread? 18 MR. LANGFORD: We have no plans to do that. I 19 think with this technology, as we've seen where other 20 people have implemented it, there are lots of "wows" or 21 "ah-ha's" that come out that really tell you things 22 about your business that you don't understand, and we're 23 starting to see that in some of the early data that 24 we're seeing now of where maybe a business process falls
25 down, you know, and why does product take so long to get For The Record, Inc. Waldorf, Maryland (301) 870-8025 121
1 to the customer, to the shelf, but no, there's no plans 2 to do that. 3 MR. WOOD: And I echo that sentiment. The 4 majority of the members who we've talked to who are 5 looking at this, that's really not a point of 6 discussion. It really is about the efficiencies that 7 Simon talked about that they really feel is the thrust 8 of this technology right now. 9 MR. GINSBURG: And the last one, Simon, is 10 recognizing that this is a long journey, all right, we 11 have to get to scale and critical mass to really get a 12 lot of the big benefits, can you describe when the -- 13 not so much the benefits, but the profitability side of 14 it, when you expect to start to see that and when you 15 think that will be on the horizon for the suppliers? 16 Clearly day one, it won't be there, right? 17 MR. LANGFORD: In terms of our suppliers, and I 18 wouldn't want to speak for our suppliers, and every 19 supplier is configured differently in supply chain 20 makeup and the volume of products that they service and 21 the number of out-of-stocks that they may have. So, 22 we're trying to focus on things that deliver return not 23 only for Wal-Mart but directly to our suppliers as well, 24 and the biggest thing is the in-stock position and
25 increased sales that I mentioned. For The Record, Inc. Waldorf, Maryland (301) 870-8025 122
1 We would start to see that and start to change 2 processes in our stores and distribution centers from 3 January, to start to go down that path, and you're 4 right, we will hit a critical mass when that starts to 5 change. 6 And just to come back on one thing about the 7 cost of implementation and the cost of software, et 8 cetera, we've approached this in a very simple way, a 9 little bit like the data I mentioned and how we are 10 keeping that, which pieces to keep and which not, and 11 we're taking the stance that if we start it at a point 12 where we integrate the EPC and take that as though we're 13 reading a bar code, just that serialized number, what 14 kind of things can we do within the application to be 15 more efficient, and then that's our starting point. 16 We are not whooshing off to change our legacy 17 systems and all our applications. So, it's one byte at 18 a time, and we haven't increased our IT spend over and 19 above what we normally budget for year after year, and 20 that will continue, and this will just be another 21 initiative, similar to the bar code and other things 22 we've implemented, whether that be -- and so on and so 23 forth, that we will just have iterations through each 24 year and continue to improve.
25 MR. HARWOOD: All right, well, I think that's For The Record, Inc. Waldorf, Maryland (301) 870-8025 123
1 all the time we have for questions. I apologize if we 2 didn't get to all of them. We had a number of them that 3 were still in the pile here, but we simply didn't get to 4 them. I do apologize for that. 5 I would like to thank all the panelists, and I 6 hope you will join me in a round of applause for them. 7 (Applause.) 8 MR. HARWOOD: And next we have Commissioner 9 Thompson, who is with the Federal Trade Commission, and 10 maybe if the panelists would just stay up here, wait 11 here and we'll go ahead and facilitate things a little 12 bit, you will have an audience as well. 13 Commissioner Thompson has a few words for us 14 before our lunch break, and he's obviously a Federal 15 Trade Commissioner, has been at the FTC since -- 16 COMMISSIONER THOMPSON: Forever. 17 MR. HARWOOD: -- forever, yes, well. It doesn't 18 seem like that long actually, but anyway. 19 REMARKS 20 COMMISSIONER THOMPSON: I hear the collective 21 growl of stomachs all through the room, so I should keep 22 it quick. 23 Well, good morning. Thank you all for being 24 here. I see a lot of familiar faces, and I'm happy to
25 see a range of people attending this conference, from For The Record, Inc. Waldorf, Maryland (301) 870-8025 124
1 industry, government and public interest groups, and I 2 appreciate you all being here to discuss this very 3 important issue. 4 Two areas to begin with, one is that my general 5 disclaimer, my words today are my own and not 6 necessarily those of the other Commissioners, and the 7 second is all of your tags have tracking devices. We'll 8 know where you're eating, and if you're not back here on 9 time, we will bar you from the room. 10 But today, we're here to talk about RFID, what 11 it is, how it can be used, what it means to business and 12 consumers alike. Now, I think our workshop today is an 13 interesting one and an important one because it 14 represents the first really broad-based conference on 15 the subject, and it will give us all an opportunity to 16 set aside some of the misconceptions we have about RFID 17 and to discuss the problems it creates but also the 18 potential benefits. 19 So, today is an important first step in a 20 process that I hope all of you will view as a continuing 21 dialogue, and I'm sure there will continue to be public 22 debate, so an opportunity for continued communication, 23 and importantly, cooperation on this subject begins 24 right here.
25 Today, we learned that RF technology has For The Record, Inc. Waldorf, Maryland (301) 870-8025 125
1 actually been around for quite some time. It's 2 currently in use in a variety of contexts. I just drove 3 back from New York last night with my E-ZPass, so 4 there's lots of examples. 5 We've also had a chance to learn a little bit 6 about the nuts and bolts, about how RF technology works, 7 starting with how the chips and the readers communicate, 8 and we've heard about what this technology can and 9 cannot do and a little bit about what its likely 10 economic impact will be. 11 Now, we also heard from experts who are 12 basically putting RFID to work in manufacturing plants, 13 in distribution centers, in the retail stores, medical 14 facilities, and in light of the breadth of potential 15 applications, it also should come as no surprise that it 16 poses a variety of privacy, security and other types of 17 questions. 18 So, having heard a little bit about the 19 potential benefits and risks of RFID, I'm especially 20 looking forward to this afternoon's discussion, which 21 will address a little bit more concretely how this 22 technology will affect consumers now and in their daily 23 lives in the future. 24 For example, streamlined supply chain management
25 can, of course, benefit consumers when they shop, For The Record, Inc. Waldorf, Maryland (301) 870-8025 126
1 creating more efficiencies and hopefully potentially 2 lowering prices. I like that. 3 But RFID may also benefit consumers more 4 directly if merchants move toward an item-level tagging 5 system, where consumers could buy things more quickly 6 and return them more easily and perhaps, more 7 importantly, recover them if they're stolen. 8 It also has some potential to have improved food 9 and product safety, but they all have questions, too, 10 these applications. Will such a system result in more 11 tracking of consumers? Will it facilitate their 12 profiling? Will it expose consumers to unwanted or 13 annoying corporate marketing? Of course, we know that 14 never happens, right? 15 Just what kind of data, how much will be 16 generated in a world where RFID is ubiquitous, and where 17 will this data go? All of these questions raise the 18 issue of what industry's responsibility will be, and of 19 course, what should be the Government's role? 20 This afternoon's panel, or perhaps more 21 accurately debate, on what the future will bring will 22 discuss this complicated and fascinating question. 23 Though I'm not sure of what this afternoon's 24 discussion's outcome will be, I am confident it will
25 take longer than today to find the answer or what the For The Record, Inc. Waldorf, Maryland (301) 870-8025 127
1 appropriate balance will be. 2 But today, we have an opportunity to have a good 3 start, so I hope we hear some creative approaches to 4 addressing the challenges that we all see before us, and 5 as we close the workshop, we'll have a chance to talk at 6 least at the outset on what kind of best practices and 7 principles might be helpful here, and during that 8 discussion, we will hear from companies who have 9 considered consumer privacy issues and have attempted to 10 accommodate them in their RFID trials, and that's not 11 just here, but also abroad as well. We'll also hear 12 some privacy experts who have seen similar challenges 13 and focus on translating industry efforts for meaningful 14 choices for consumers. 15 Now, I know that none of these approaches alone 16 may work for all of the questions that we have on RFID, 17 but together, they may hopefully lead us to meeting the 18 challenges that will be laid out today. At the very 19 least, they will help to inform the policy makers and 20 businesses and consumers about how to better balance the 21 risks and the benefits posed by RFID. 22 So, I hope to see you again talking about this 23 subject, hopefully not as defendants but as participants 24 in an ongoing dialogue to find what the appropriate
25 balance is for RFID and to also talk to consumers about For The Record, Inc. Waldorf, Maryland (301) 870-8025 128
1 how they can make meaningful choices in using new 2 technology. So, thank you very much for coming, and I 3 hope to see you after lunch, or I will go out and find 4 you. Thank you. 5 MR. HARWOOD: Thank you, Commissioner Thompson. 6 (Whereupon, at 12:00 p.m., a lunch recess was 7 taken.) 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24
25 For The Record, Inc. Waldorf, Maryland (301) 870-8025 129
1 AFTERNOON SESSION 2 (1:07 p.m.) 3 PANEL 3 4 MR. LIVINGSTON: Good afternoon and welcome back 5 from lunch. My name is Ted Livingston. I'm a 6 consultant who has been doing some work for the 7 Commission in the area of emerging technologies and 8 their impact on consumers and particularly consumer 9 privacy. 10 My colleague as moderator on this panel is Ellen 11 Finn, who is a staff attorney in the Division of 12 Financial Practices here at the Commission. 13 Our topic is the implications of RFID use on 14 consumers, and we're really in the next two hours going 15 to try to focus on the consumer and probably not so much 16 on the supply chain, which you heard quite a bit about 17 this morning, and address the benefits to consumers of 18 RFID technology and some of the concerns that consumers 19 may have or maybe should have about the technology, 20 particularly as it relates to privacy issues. 21 Our goal for this panel is to have it be as much 22 of a dialogue as possible, and with that in mind, we've 23 asked our panelists to limit their comments to five to 24 eight minutes, and we're even calling them comments
25 instead of presentations, so that hopefully we will be For The Record, Inc. Waldorf, Maryland (301) 870-8025 130
1 able to finish that part of the panel in about an hour, 2 and then we hope to have a lively discussion and 3 question and answer period for the second hour. 4 With that in mind, as you know, we have these 5 question cards. If you can put which panelist or 6 panelists you would like the question addressed to, as I 7 think most of you did this morning, that would be 8 helpful, and what we're going to try to do is ask the 9 question of that panelist or panelists and then ask 10 anyone else among the people up here at the table as to 11 whether they would like to comment on that question as 12 well. 13 So, with that, I will turn it over to Ellen, who 14 is going to introduce our presenters. 15 MS. FINN: Full bios for all of the panelists 16 are available in your materials, so I am not going to 17 give them lengthy introductions, just a sentence or two 18 each to kind of orient as to who they are as they speak, 19 and rather than go down this long table so that by the 20 time someone opens their mouth, people have actually 21 forgotten who they were, I am going to introduce them 22 one at a time as they speak. 23 The first person who is going to make a few 24 comments is John Parkinson immediately to my left. He
25 is a Vice President and Chief Technologist for For The Record, Inc. Waldorf, Maryland (301) 870-8025 131
1 Capgemini's Americas Region and member of the Group's 2 Office of the CTO. In 2004, he was named as co-chair of 3 the ITAA Committee on RFID and the chair of ITAA Task 4 Group on Public Policy Formulation for RFID, and he is 5 going to share some information about some research 6 CapGemeni has done on RFID and his perceptions of it. 7 MR. PARKINSON: Great, thank you very much. I 8 do need to at least use some footnotes, because I'm a 9 consultant. That's what we do. 10 So, last year in October we with the National 11 Retail Federation (NRF) decided to try and get some 12 quantitative sense of where the consumer was with RFID, 13 and we did this via an internet panel, which I readily 14 admit already biases the sample, since if you can't get 15 onto the internet, you weren't reviewed for the 16 research, but we asked a fairly structured series of 17 questions about what people understood about RFID, what 18 their concerns were about it, and what they saw as the 19 potential benefits from it, and those results are 20 presented here very briefly. 21 There is a published report based on this that 22 was released jointly by Capgemini and the NRF, which is 23 available from either of our Web sites, or if you want 24 to see me afterwards, I'll be happy to send you a copy.
25 The first issue was, why should we worry about For The Record, Inc. Waldorf, Maryland (301) 870-8025 132
1 consumers? Almost all of our work today is with 2 manufacturers and the supply chain. The answer is 3 because at the end of every supply chain, there is a 4 consumer, and if the consumer doesn't understand the 5 benefits and the issues around the application of RFID, 6 then some of those benefits won't be realized, and 7 because we believe they are significant to everything up 8 to the consumer and potentially to the consumer as well, 9 we wanted to get a sense of where everybody's head was 10 around this. 11 This was coincident with the Wal-Mart 12 announcement that got some press release. It was after 13 a number of issues had been raised in the media around 14 the use of RFID tags, particularly post-sale 15 identification tags. So, it's very hard to judge what 16 people really get about this. So, this is why we did 17 the research. 18 So, what did we find? We found essentially that 19 most people have no idea what RFID is. Not a surprise. 20 It's another of those brand new 50-year-old technologies 21 which is about to roll out into some part of society. 22 So, only about a quarter of the people who were 23 interviewed had any idea. 24 Now, in the "no, we have no idea what it is,"
25 there were a significant number of people who routinely For The Record, Inc. Waldorf, Maryland (301) 870-8025 133
1 use either a toll tag or Mobil Speed Pass, both of which 2 are RFID devices, and they had not associated their 3 routine use of those devices with the term RFID. In 4 fact, there were a number of comments that until it 5 showed up on TV, I think they quoted an episode of 6 Alias, they hadn't made the association between the 7 device and the concept. 8 Men are slightly more likely to have heard of it 9 than women, but not significantly, and people in the 10 survey got their information from all over the place. 11 There was no standard source to go to for reference 12 material. 13 So, we then said, okay, what do you think about 14 it? And slightly surprisingly -- two slightly 15 surprising things here. One is that most people, the 16 largest single group, had no opinion. So, the second 17 largest group were favorable, which is a broad spectrum 18 of response. Only 10 percent explicitly said that they 19 had an unfavorable view about RFID. So, this is in 20 contrast to some of the material you have seen in the 21 media up until now. And we did find that there was a 22 lot of interest. 23 So, what were the concerns? Surprisingly, the 24 biggest concern was about the impact on price. This is
25 a new technology rolling out. A lot of people thought For The Record, Inc. Waldorf, Maryland (301) 870-8025 134
1 it would put the price of the goods they were buying 2 that were involved in RFID programs, the price would go 3 up. 4 Secondly, we asked them what they thought the 5 benefits would be, and again, slightly surprisingly, 6 there was a perception that -- again, I think because 7 people think about systems like LoJack, it would be 8 easier to recover stolen goods, and then there was a 9 view that there might be some decreased costs once the 10 supply chain impact had worked its way through, and 11 there was some perception that application to the 12 prescription drug industry would improve safety. 13 So, when we asked would people be willing to 14 actually buy goods with RFID tags to get these specific 15 benefits, the general view was, "Yes, if," and the "if" 16 was where the privacy issue first raised itself, and the 17 top concerns around RFID cycled back to this issue of 18 privacy, that the data would be available to third 19 parties without permission, that you would be exposed to 20 more targeted direct marketing, which nobody seems to 21 like, and that it would become possible to track 22 consumers via their purchases. 23 Given how little information people had or 24 understood about RFID, there's relatively low
25 correlation between understanding and the responses to For The Record, Inc. Waldorf, Maryland (301) 870-8025 135
1 these questions. There was also some issues about 2 health, which we see show up every time, anything to do 3 with the electromagnetic spectrum it gets raised with, 4 it seems. 5 We asked if people felt that the RFID issue was 6 greater or less than other kinds of trackable devices or 7 trackable systems, and in general, we got a, yes, we 8 think it probably is pattern of response. Even people 9 who don't, again, necessarily fully understand the 10 technologies that lie behind some things like debit 11 credit cards felt that RFID would be worse than that. 12 What would you like us to do about it? Let's 13 get some legislation in place that at least tells us 14 what it is people are allowed to do. Let's look at the 15 viability of killing tags post-purchase. Let's look at 16 opt-in/opt-out systems, where at least you could tell 17 merchants whether or not you wanted tagged devices and 18 whether they wanted them killed. And let's at least put 19 a label on the goods and services that we buy that 20 clearly state whether they're tagged or not. 21 We asked people how long they thought RFID would 22 take to come into widespread use, and generally 23 speaking, people thought five years was about the right 24 number. Only 3 percent said that it would never happen,
25 and that did not correlate to knowledge of RFID. For The Record, Inc. Waldorf, Maryland (301) 870-8025 136
1 However -- and again, slightly surprisingly -- a much 2 larger percentage said they would prefer that it didn't 3 happen. So, we probably need to go back and do another 4 survey to try and drill more deeply into why there's 5 that contrast between inevitability and desire, and we 6 have some plans to do that. 7 So, what did we conclude from that? Currently, 8 not many people really know about RFID, and even people 9 who do don't know very much about it. There's a growing 10 explicit interest and growing concerns around RFID -- 11 not all that surprising -- that it would be better we 12 think to communicate more about the reality of RFID to 13 consumers now rather than waiting until it's a more 14 widespread phenomenon, and that education is the route 15 to the consumer mind set, in particular to re-assure 16 them around health issues, to explain that some of the 17 things that they worry about are things that the 18 industry dreams it could do -- nowhere near capable of 19 doing today -- and to help guide the legislative 20 efforts, because from our perspective as an industry, we 21 want to do the right thing to get the benefits from 22 RFID, but we can't yet tell what the right thing is. 23 The appropriate use guidelines, we would assert, 24 need to be built now so that by the time we have
25 capability, we know we're using it for the right things. For The Record, Inc. Waldorf, Maryland (301) 870-8025 137
1 Our concern is that if we as an industry don't do this, 2 then it's likely that other groups with other agendas 3 will. 4 So, what should we do? Let's look at the 5 sources of insecurity and figure out what we should do 6 about them. Let's as an industry at least get behind 7 the explicit marketing of goods that are tagged, try and 8 disconnect the technology, which is just a technology, 9 from the broader issue around privacy and the use and 10 potential misuse of consumer information and get clear 11 guidelines on appropriate use worked out, and then 12 publish and adhere to whatever those policy guidelines 13 might be. 14 We need to get moving on this, because the 15 mandate-driven market we have today is moving RFID along 16 much faster than most of us from a technical perspective 17 expected, and we do not want to lose the trust of the 18 consumer in this. We as an industry want to be sure 19 that the consumer knows what they're getting before tags 20 start showing up in places they don't expect. 21 Now, there's some clear benefit models 22 associated with this, and we'd like to explain those to 23 consumers and let them decide how much of those benefits 24 they want to pay for the price of the goods they buy at
25 retail. For The Record, Inc. Waldorf, Maryland (301) 870-8025 138
1 Thank you very much. I will be happy to answer 2 questions later. 3 Mallory? 4 MS. FINN: Thank you. 5 Our next speaker is going to be Mallory Duncan. 6 He has served as Senior Vice President and General 7 Counsel for the National Retail Federation for the past 8 ten years, and he's responsible for coordinating 9 strategic, legislative and regulatory initiatives 10 involving customer data privacy, financial services and 11 consumer protection. 12 MR. DUNCAN: Okay, thank you and good afternoon. 13 By way of background, the NRF, who worked with 14 Capgemini on the study, is the world's largest retail 15 trade association. Our membership consists of all 16 formats of retailers. We cover household names, from 17 Saks to Sears, all formats, from a local haberdasher to 18 Home Depot. I am very pleased to be here today. 19 RFID and EPC are critically important to our 20 customers. As virtually everyone has acknowledged, 21 widespread item-level tagging is still quite a ways off, 22 yet as the Capgemini study makes clear, the privacy 23 implications of tagging seems to be on everyone's minds. 24 Privacy issues, while potentially significant,
25 are only a portion of the RFID picture. Whether they For The Record, Inc. Waldorf, Maryland (301) 870-8025 139
1 achieve significance is dependent upon the handling of 2 four other issues related to it: Education, notice, 3 choice and value. 4 Let me start with just a few observations. One, 5 individuals are notoriously bad at assessing the 6 economic value of a new concept in the abstract. 7 Second, for many, uncertainty is frightening. 8 Confronted with the unknown, they tend to fall back on 9 re-assurances, family, home, hearth protection. 10 Three, in the period before society has an 11 opportunity to comprehend, experience and reach 12 consensual accommodation, new technology is often 13 characterized as creating unwarranted privacy 14 intrusions. 15 Now, use of RFID technology in retail stores is 16 still in its earliest stages. As the study indicates, 17 most consumers have not heard of the technology, and 18 those who have, reactions appear to reflect these three 19 observations. 20 For example, on the positive side, given its 21 newness, it's not entirely surprising that consumers 22 value highly the potential for the technology to satisfy 23 safety and security concerns, recovery of stolen items, 24 antitheft capabilities, prescription drug security, et
25 cetera, and frankly, inasmuch as society still places For The Record, Inc. Waldorf, Maryland (301) 870-8025 140
1 the bulk of the nurturing burden on mom, these same 2 family safety potentials might explain why the study 3 found that women tended to rate the benefits of RFID 4 slightly higher than men. 5 Now, improvements such as fewer out of stock, 6 faster checkouts, were likely ranked lower than 7 anticipated in the study, because consumers have not yet 8 experienced the world in which those things happen; 9 thus, it's difficult to appreciate their value. 10 Similarly, consumers say they're unwilling to 11 pay extra for service they can't now imagine. Two 12 decades ago, if you had wanted to ask consumers how much 13 they would have been willing to pay for a telephone they 14 could remove freely from the wall, it's likely most 15 would have said little or nothing. It's virtually 16 certain they would not have given a figure comparable to 17 the $69 per month many cell phone users now pay for that 18 extra service. 19 As to privacy, privacy-related questions scored 20 high in both the unaided and preprogrammed responses to 21 the study, again, not entirely surprising. When new 22 technology expands sensory reach, it inevitably reaches 23 previously ingrained expectations. Individuals react to 24 change as a privacy violation. Eventually an
25 accommodation is reached, from which arise new For The Record, Inc. Waldorf, Maryland (301) 870-8025 141
1 expectations. 2 The internet, email within it, cell phones, are 3 all undergoing that process right now. The most famous 4 law review article, "Eliminating the Right of Privacy," 5 published near the turn of the prior century, was 6 written in response to that era's cutting edge 7 technology, telephoto lenses. 8 Now, let me suggest a proposition. Unless we 9 are aiming to arrest potential benefits, we shouldn't 10 write laws in response to imagined difficulties. 11 Currently, virtually everything about the future of RFID 12 is unsure. We need to see what uses develop, whether 13 where the technology is used in practice falls within or 14 outside of our comfort zones, before we can regulate its 15 use. 16 An early law prohibiting the photographing of 17 strangers might have stopped peeping toms and killed 18 most photo-journalists. A law making it illegal to 19 telephone unknown persons would have curtailed some 20 telemarketing, but it would have effectively prohibited 21 nationwide public opinion polling and the 911 system. 22 As technology evolves and technology passes, one 23 can anticipate a more realistic balance between consumer 24 benefits and concerns. Regulations should be considered
25 only if evolving technology use practices fail to meet For The Record, Inc. Waldorf, Maryland (301) 870-8025 142
1 consumer expectations. 2 NRF believes that the privacy policy 3 recommendations that our board adopted are applicable 4 here. Our policy recognizes that in a highly 5 competitive retail marketplace, maintaining the trust of 6 one's customers is essential. There may be millions of 7 retail outlets, but in the real world, customers shop at 8 a fraction of 1 percent. For most retailers, repeat 9 business is essential. If a dissatisfied customer walks 10 to another store down the mall, the retailer hasn't lost 11 a sale; he's lost dozens of sales or perhaps scores of 12 dozens of sales. 13 As applied to RFID, that means that there's a 14 need for education. It's important that consumers learn 15 the RFID basics, its uses in EPC, and receive a 16 realistic expectation of its potential. 17 Second, there should be notice. The early 18 stages of deployment, when interest in new products is 19 naturally high, is an ideal teachable moment. 20 Currently, a small number of retailers and manufacturers 21 are leading that process. They've begun, but others 22 need to follow. There must be choice. 23 As with privacy policies, retailers should 24 provide customers with options. For example, they
25 should allow customers to opt out if they do not want to For The Record, Inc. Waldorf, Maryland (301) 870-8025 143
1 receive marketing solicitations or have their 2 information for marketing purposes sent to a third 3 person. In some cases, the option, however, would be to 4 choose another retailer. 5 Information received by a retailer should be 6 subject to reasonable and responsive security and access 7 provisions, and the entire process should be managed 8 with an eye towards value for the consumer. A more 9 cost-effective supply chain is one such value. 10 As the caption on our research demonstrates, 11 consumers will need to see the benefits of deployment in 12 order to fully appreciate its value. The concept of a 13 Blackberry is not nearly as appreciated as its value. 14 The potential for overly harsh regulation of new 15 technology is a constant threat. The values of RFID and 16 EPC will only be realized if retailers act thoughtfully, 17 carefully and adhere to the simple principles that have 18 always been at the heart of building customer trust. 19 Thank you. 20 MS. FINN: Thank you. 21 The next speaker we are going to hear from is 22 Beth Givens, who is a familiar face to many people in 23 this room. Beth is the Founder and Director of the 24 Privacy Rights Clearinghouse. Established in 1992, the
25 PRC is a nonprofit consumer education, research and For The Record, Inc. Waldorf, Maryland (301) 870-8025 144
1 advocacy research organization located in San Diego. 2 MS. GIVENS: Thank you, and thank you for the 3 opportunity to speak here today and to participate. 4 Just a couple of words about the Privacy Rights 5 Clearinghouse, because it will help explain some of the 6 comments I want to make later, we interact directly with 7 individuals. We invite their calls and their emails, 8 and we're kind of the Dear Abby of privacy. We have 9 been doing this now for a dozen years, and quite 10 frankly, we have heard just about everything, although I 11 continue to be amazed and curious about what we do learn 12 about from individuals who are experiencing privacy 13 abuses and problems in the marketplace. 14 What I wanted to talk about today are four 15 things. I'll first summarize the characteristics of 16 RFID that could threaten privacy and civil liberties, 17 and that will be the focus of my talk. I will follow by 18 critiquing some of the technology-based proposals for 19 mitigating these privacy concerns. Then I'll say a few 20 words about consumer education, something that I think 21 we'll be hearing a lot about today and in the near 22 future. And I'll close by calling for a comprehensive 23 multi-disciplinary technology assessment of RFID. 24 So, to begin, industry representatives have
25 described many benefits of RFID today, but RFID is a For The Record, Inc. Waldorf, Maryland (301) 870-8025 145
1 classic information technology in that there is a 2 potential downside as well. If the technology is 3 implemented irresponsibly, we as a society could 4 experience it not as a wonderful convenience with many 5 social benefits, but rather, as a tool for consumer 6 profiling and tracking. In other words, as one part of 7 a larger surveillance infrastructure. So, the key 8 question is, how do we shape the implementation to 9 ensure the socially beneficial aspects and to prevent 10 the negative ones? 11 Just to summarize, RFID has several qualities 12 that working together could threaten privacy and civil 13 liberties, and these are, first, the bit capacity of the 14 tags sufficient to uniquely identify all objects on the 15 globe; second, the fact that tags and readers can be 16 installed invisibly, enabling tags to be read from a 17 distance without the individual's knowledge and consent; 18 and third, the database, something that we have really 19 not talked about enough I think, the databases that are 20 developed to compile, store and analyze that vast amount 21 of data gathered as those products make their way from 22 the factory to the point of sale and perhaps beyond. 23 Now, it's the "beyond" that is of concern to 24 privacy and civil liberty advocates. That's where the
25 item-level data on the tag could be combined with For The Record, Inc. Waldorf, Maryland (301) 870-8025 146
1 personally identifiable information, at least at the 2 database level. So, put these qualities together, and 3 yes, there is potential to create a comprehensive 4 infrastructure for individual tracking and profiling, 5 something that we want to, of course, avoid. 6 A variety of technology-based fixes have been 7 proposed to mitigate the potential threats. For 8 example, killing the tags at the point of sale and 9 providing tag-blocking devices to individuals. However 10 appealing these so-called solutions appear upon first 11 glance, they in my opinion as a consumer educator and 12 consumer advocate are not very satisfying. 13 Killing tags or blocking them does not address, 14 for example, in-store tracking, and some of the 15 strategies for tag-killing are inconvenient, like killer 16 kiosks, for example, taking your load of groceries over 17 to a kiosk and then de-activating the tags after you 18 shop with two young children in tow and having just 19 spent a hundred dollars to fill up that bag or that 20 cart. My experience as a consumer educator is that 21 these activities will only be used by a small portion of 22 shoppers. 23 Further, merchants could offer incentives or 24 disincentives to not kill tags, for example, making it
25 more difficult to return or exchange items that do not For The Record, Inc. Waldorf, Maryland (301) 870-8025 147
1 have working tags on them. While some might think that 2 this is unlikely and that the retail industry would not 3 do this, we only have to look at the present day 4 situation around product returns to realize that it's 5 really not out of the picture. 6 I mentioned that we have been talking with 7 consumers for a dozen years now. Consistently, year 8 after year, in the top ten of our complaints are 9 complaints about merchants who require individuals, when 10 returning items with a receipt in hand, to provide name, 11 address and driver's license number. Otherwise, they 12 cannot return those items. This is not an unlimited 13 practice. We've got in our database the names of all of 14 the major retailers in the U.S. So, this sort of thing 15 could happen with RFID, kind of a disincentive or 16 incentive to keep those tags working. 17 Disadvantages that I see for blocker tags are 18 that they, like the killer kiosks, add a burden to 19 consumers. They fail to protect consumers when those 20 products are separated from the blocker tag, and like 21 the kill choice, they create two categories of 22 consumers, those who take the time and energy to 23 deactivate and the larger number for whom deactivation 24 is inconvenient or is without meaning.
25 Industry representatives are calling upon For The Record, Inc. Waldorf, Maryland (301) 870-8025 148
1 consumer education as an important way to mitigate 2 consumers' concerns and to instruct individuals on the 3 choices that they have to protect their privacy. As a 4 consumer educator, I take this recommendation very 5 seriously. It strikes very close to home, and I think 6 it's very important to differentiate between a true 7 consumer education campaign and a public relations 8 campaign. There's a big difference between the two of 9 them, and let me give you one example of a consumer 10 education campaign that I was involved in many years 11 ago. 12 In 1996, we at the Privacy Rights Clearinghouse 13 participated in a comprehensive consumer ed campaign 14 revolving around Caller-ID in California. The message 15 of consumer choice revolving around which blocking 16 option, a comprehensive blocking or selective blocking 17 of your phone number as it goes out over the wires, was 18 basically the message that needed to be transmitted to 19 Californians. 20 So, the message was developed by a committee 21 that was comprised of representatives of all 22 stakeholders, the phone industry, the regulators and the 23 consumer advocates, and that message was not finalized 24 until we could all agree upon it, and that message was
25 ultimately conveyed by multiple media, TV, radio, For The Record, Inc. Waldorf, Maryland (301) 870-8025 149
1 newspapers, and in many languages. 2 By the time the Caller-ID was launched, a survey 3 was done, and it showed that two-thirds of consumers 4 were aware of their choices, and the effort was guided 5 by an academician, who was a communications scholar from 6 Ohio State University, and her expertise was in the area 7 of public information campaigns. So, that is what I 8 would call a consumer education campaign. 9 In convincing with the consumer ad initiative 10 for RFID, I strongly recommend the development of 11 strategies borrowed from such efforts as I just 12 explained. 13 Now, last November, 50 consumer, privacy and 14 civil liberties advocates got together and released a 15 position statement on RFID. That was led by CASPIAN, 16 the Privacy Rights Clearinghouse, along with EPIC, EFF, 17 the ACLU and others. You can find that statement on our 18 Web site, privacyrights.org, as well as several other 19 Web sites. 20 We call for the implementation of RFID to be 21 guided by the Fair Information Principles, something I 22 will not talk about now because it will be discussed 23 later, but what I do want to spend just a few moments on 24 is what we called for, which was a comprehensive
25 technology assessment to be conducted by an impartial For The Record, Inc. Waldorf, Maryland (301) 870-8025 150
1 body or group of impartial bodies, akin to the type of 2 assessments done by the Congressional Office of 3 Technology Assessment that existed from '72 to '95. 4 Even though industry is moving full speed ahead 5 with RFID, I continue to believe that such an assessment 6 is vitally important for the responsible implementation 7 of the technology. Ideally it would consist of a 8 multi-disciplinary analysis covering the expected 9 benefits as well as the expected adverse impacts. It 10 would include not only privacy and civil liberties, but 11 also labor impacts, which I think are going to be huge, 12 environmental health implications, and of course, what 13 we're talking about here today, which is privacy. 14 It would be overseen by an impartial body, 15 perhaps a body like the Federal Trade Commission, the 16 National Academy of Sciences, an academic institution or 17 perhaps working together as a consortium, but 18 "impartial" I think is the key word. 19 Just let me throw out two or three questions 20 that could be addressed by a technology assessment. One 21 would be what would be some of the unintended 22 consequences, something we oftentimes learn way too 23 late. 24 Second would be are there other technologies
25 that could do some of the same things but are less For The Record, Inc. Waldorf, Maryland (301) 870-8025 151
1 intrusive, and I think Intel brought that up today with 2 the discussion of 2D bar codes. 3 Then third, do we need to have all of these 4 items in the world uniquely identified? Could radio 5 frequency identification work well with just a bar code 6 level being emitted, generic information? For example, 7 bringing your computer to the landfill. It doesn't have 8 to say, "Lead inside, and this lead belongs to a 9 computer that was paid for by Beth Givens in August 1983 10 purchased at Circuit City." It could just simply say 11 "lead inside" or "mercury inside" or "nickel cadmium 12 inside." So, there could be an RFID implementation that 13 is not quite so intrusive as the EPC. 14 One of the aspects of Congress' technology 15 assessment that I liked the best was that it came up 16 with not one policy solution but several, so that 17 lawmakers, industry and others could see different 18 scenarios based on, say, low regulatory environment, 19 moderate or high. 20 In closing, I strongly recommend that the FTC or 21 perhaps the National Academy of Sciences, a scientific 22 or academic institution or even a consortium approach 23 take this approach. Now, we've already got several 24 pieces of a technology assessment in the works,
25 industry, some academic institutions, consumers groups. For The Record, Inc. Waldorf, Maryland (301) 870-8025 152
1 I think we have a good start, but we need that impartial 2 look at this technology. 3 With that in mind, I close with a quote from 4 Senator Patrick Leahy, and I think he wraps everything 5 up that I said quite nicely in one sentence. He said, 6 "We need clear communications about the goals, plans and 7 uses of the technology so that we can think in advance 8 about the best ways to encourage innovation while 9 conserving the public's right to privacy." He said that 10 in March of 2004. 11 Once again, thank you for the ability to 12 participate today, and I'll look forward to the 13 questions and discussion. 14 MS. FINN: Thank you, Beth. 15 The next person who will speak is Deirdre 16 Mulligan. Deirdre is Acting Clinical Professor and 17 Director of the Samuelson Law, Technology and Public 18 Policy Clinic at the Boalt School of Law at the 19 University of California, Berkeley, and she came to 20 Boalt from the Center for Democracy and Technology, 21 where she worked on privacy and free speech issues. 22 MS. MULLIGAN: Thank you. It's a pleasure to be 23 here this afternoon. 24 I run a clinic, as she mentioned, which is kind
25 of the lab component of law school, and so students both For The Record, Inc. Waldorf, Maryland (301) 870-8025 153
1 from our computer science, information sciences and from 2 the law school work with me on different kinds of 3 projects. Some of them might be actual litigation or 4 legislative activity, and some of them are more 5 research-oriented. 6 We have been engaged in a variety of 7 research-oriented activities around RFID and more 8 broadly what we call pervasive computing. I believe Ken 9 Fishkin mentioned kind of pervasive computing. We've 10 heard sensor networks thrown out. So, the notion that 11 computers are going to be embedded into our physical 12 environment in so many ways, in the virtual world, where 13 people are concerned about cookies and people tracking 14 what they do online all of a sudden meets the physical 15 learn, where the kind of tracking that we've only 16 imagined occurring online is now embedded in the world 17 around us. So, they're not tracking your clicks; 18 they're now tracking where we go. 19 I think Ken Fishkin had some really elegant 20 examples of the kind of neat things we can do, the 21 invisible man or the invisible woman, you might say, but 22 there are also some real privacy concerns. 23 I remember being here in 19 -- I don't know, 24 maybe '95 and then Chairman Pitofsky talking about they
25 don't only know online that I chose the salmon, they For The Record, Inc. Waldorf, Maryland (301) 870-8025 154
1 know that I considered the beef, right, and so there is 2 an awful lot that we can infer from the use of this 3 information. 4 We have been particularly focused on a very 5 special kind of good, and that good is information 6 goods. Information goods, books, CDs, DVDs, all that 7 intellectual property that we hear about, they play a 8 very special role in our society, right? We have 9 protections stemming from the First Amendment and the 10 Fourth Amendment that protect governments from trying to 11 get a hold of what it is that we're reading, right, so 12 whether it's limiting government access to records that 13 might be held by a bookstore about who's purchasing 14 books -- you will remember the Monica Lewinsky and 15 Kenneth Starr debacle here at Kramerbooks -- so there is 16 some Constitutional protections. 17 In the absence of Constitutional protections, we 18 have had Congress repeatedly step in and say, well, even 19 where we might not have a Constitutional issue, we're 20 very concerned about the freedom of inquiry, right, as 21 we see it as the corollary to freedom of speech. If all 22 of us can speak but the government is kind of then able 23 to see who's kind of listening to whom, we are going to 24 have this chilling effect, the same way we might if
25 everyone was forced to disclose who they were before For The Record, Inc. Waldorf, Maryland (301) 870-8025 155
1 they entered the great marketplace of ideas. 2 So, people often talk about privacy law being 3 very patchwork and unsystematic, and in fact, when we 4 talk about information goods, Congress has stepped in 5 pretty frequently, and there is the Bork -- during 6 Bork's confirmation hearings, people may remember this, 7 an enterprising reporter at The City Paper here in D.C. 8 got hold of Judge Bork's video rental list and said, oh, 9 nothing interesting, but people on the Hill said, oh, 10 could have been something interesting, right, so we have 11 the Video Privacy Protection Act passed which provides a 12 protection for our private viewing habits. We have 13 rules that protect cable viewing. 14 At the state level, dealing with libraries, I 15 think it's 48 states -- and there's probably a librarian 16 in the room who will correct me -- but I think it's 48 17 states have state legislative protection around 18 librarying of patron records. So, we have a very rich 19 culture of protecting the privacy of our freedom of 20 inquiry, what it is that we're accessing. 21 The good news is information goods providers 22 generally are into this culture of confidentiality, 23 right? So, book stores oppose subpoenas that are 24 overbroad that they think are inappropriate. Libraries
25 have very strong kind of, you know, their Constitutional For The Record, Inc. Waldorf, Maryland (301) 870-8025 156
1 kind of principles that protect privacy. 2 So, what does this have to do with RFID? It was 3 mentioned earlier that libraries are implementing RFID 4 systems. There's been a lot of focus on libraries. I 5 think it's good to kind of step back, and libraries, as 6 I said, have this very strong culture backed by state 7 law of confidentiality protections. Most of the other 8 retailers that deal with books do not, right, and so 9 certainly many of them step up to the plate in the 10 context of books and protect privacy when a government 11 subpoena or private subpoena might come around. 12 When we talk about introducing something like 13 RFID into the mix, it gets a little bit more 14 complicated. So, we have some threats that I think are 15 important to think about. 16 RFID, as I mentioned, it works on a broadcast, 17 right, so my RFID tag is talking to everybody, this word 18 promiscuous, which I have a really good slide in a 19 little bit to talk about promiscuous tags. There is no 20 access control on this. We can't even think about 21 eavesdropping, because the whole intent of the 22 technology is to let everybody listen. So, depending on 23 what is embedded on that tag, right, we could be 24 overhearing lots of different things.
25 People have talked about tracking point to For The Record, Inc. Waldorf, Maryland (301) 870-8025 157
1 point, all right, so we can track as an individual moves 2 potentially, but I think also, interestingly, we can 3 track as a good moves. So, if I know that Deirdre 4 purchased a particular book, we can now figure out who 5 it is that Deirdre is lending things to, or if we've 6 decided that a given person who we've decided is suspect 7 has a certain kind of good, we can look for other people 8 who might have that kind of good, and when that good 9 happens to be a book or something that is about our 10 inquiry, I think that that kind of tracking raises 11 particularly, you know, troublesome concerns. 12 Beth mentioned the invisibility of the tags and 13 readers. We've talked a little bit about joining data. 14 I want to look a little bit -- there are some real 15 important differences between the RFID technologies 16 being deployed in libraries and the RFID technology that 17 we're talking about, primarily EPC standard, in the 18 general commercial space. 19 Libraries, as I mentioned before, you know, they 20 really live and breathe privacy. Many of you are 21 probably familiar with the whole debacle around Section 22 215 of the Privacy Act. Libraries are very, very 23 concerned about Attorney General Ashcroft coming in with 24 subpoenas that they can't talk about for people's
25 borrowing records. For The Record, Inc. Waldorf, Maryland (301) 870-8025 158
1 So, if you look at -- the most important 2 differences here, the read range, right, library read 3 ranges for the little tags that we have are one to four 4 feet, pretty close proximity, versus the EPC tags, 20 to 5 30 feet, you know, depending on the environment. The 6 labeling protocols, in the library setting, there isn't 7 a standard, and there's not a standard for the 8 technology. There's a bunch of different standards that 9 are out there, and some of them are proprietary and not 10 really standards, and there's also no labeling protocol. 11 So, libraries are doing different things. They tend to 12 be library-specific. So, it's much more difficult to 13 correlate, well, you're borrowing this book, and so this 14 book over here that has the same identifier must be the 15 same book. It doesn't really work that way in a library 16 setting. 17 In EPC, with this 96-bit globally unique ID, you 18 will see we have a slightly different picture 19 potentially. So, here are the two books, and I love -- 20 these are my promiscuous tags -- I'm sorry, I just had 21 to do that -- so, in the EPC version, the tag might 22 actually be saying something like, you know, this is a 23 Penguin Publisher, it's Catcher in the Rye, and this is 24 copy 51034. Now, if that, in fact, is what's being
25 broadcast, I think many people would find that quite out For The Record, Inc. Waldorf, Maryland (301) 870-8025 159
1 of sync with their own expectations of, you know, who's 2 going to have access to what they read. In the library 3 setting, it's more likely to be this string that doesn't 4 necessarily add up to anything much. 5 Now, we've had a little bit of a conversation 6 about the back-end databases. Part of that depends upon 7 what this tag points to and what kind of access controls 8 are on that tag. Somebody stated earlier, I think it 9 was the first -- Sue Hutchinson, I think was her name, a 10 woman who spoke early this morning -- and she said that 11 all of these servers are sitting behind firewalls at 12 companies, and I actually don't think that's going to be 13 the case. I think that there are going to be all 14 different kinds of servers. 15 Many of you are probably familiar with the 16 internet movie database where you can go and look up a 17 movie. You can certainly go in some libraries and using 18 the ISDN number get to a book, right? So, you can use a 19 number to look up the content. We are all very familiar 20 with reverse lookups with phone numbers. It used to be 21 I could only look Beth up by her name, now I can look 22 her up by her number and get her name. And here, too, 23 depending upon the availability of the databases and 24 what kind of access we have to them and how centralized
25 they are and what their rules are, we can have very For The Record, Inc. Waldorf, Maryland (301) 870-8025 160
1 different things coming out of both of these contexts. 2 So, I am going to end with some conclusions, 3 solutions and recommendations. I think that, you know, 4 with respect to information goods in particular, RFID do 5 pose a substantial privacy risk, and what's important I 6 think from the FTC's perspective is that I think it does 7 violate established public policy. I think people have 8 very deeply ingrained, legally protected in some 9 instances, collectively shared expectations that the 10 books that they borrow, the books that they purchase, 11 the movies they watch in their house, that there is some 12 privacy protections that people aren't able -- you know, 13 I take the book, I buy it, I put it in the bag. I don't 14 want the book talking to other people and telling people 15 what I'm reading. If we don't think about that when 16 we're deploying the technology, there's a potential to 17 run right into those in a way that I think people would 18 really find very unfair. 19 Many of the solutions that have come out are 20 either inadequate or they're not particularly useful in 21 the context of information goods. Information good 22 markets are different. They don't tend to be like the 23 sweater that I buy and eventually it falls apart and I 24 ditch, right, or it ends up in the -- books tend to
25 revolve in the marketplace. We have many lending For The Record, Inc. Waldorf, Maryland (301) 870-8025 161
1 institutions, not just libraries, but video rental, you 2 know, we have much more of a culture of exchange, and 3 people also tend to collect and archive. 4 If you remember the CueCat device, which was 5 sent out -- I don't remember which business introduced 6 it into the market, but you could take it and we were 7 all supposed to get our magazine, wave the little CueCat 8 and be linked to a Web site that was going to market to 9 us, and some good engineers decided to hack into it, 10 reverse it and use it to catalog their CDs and catalog 11 other things that had these little bar codes on them. 12 And consumers are very interested. 13 There's a whole bunch of software programs out 14 there, all different kinds of things that help us 15 archive our collections. So, I actually think that 16 there are some interesting consumer end uses for RFID, 17 but I certainly know that to the extent that we have a 18 revolving market, we have book stores that are both new 19 and used, we have people who routinely sell books back, 20 that killing tags doesn't necessarily kind of fit in 21 that kind of marketplace. It sure doesn't work in the 22 library setting. 23 I do think there's a role for the FTC. Beth and 24 some other folks have spoken about a formal technical
25 and policy assessment of RFID technology. I'm doing For The Record, Inc. Waldorf, Maryland (301) 870-8025 162
1 that now, and I think that it would be really nice to 2 have a formal process rather than the ad hoc process 3 that we have going on in various areas. 4 I do think that it's really important when we're 5 looking at technology not to say, oh, any law is bad. 6 In fact, I think RFID, and there's been a host of other 7 technologies, we've actually shied away from some of the 8 more interesting potentially innovative uses, because 9 researchers get anxious because, oh, when we're dealing 10 with people, we have these privacy concerns. Let's 11 track the trees. Let's look at the ducks. Let's stay 12 away from the people. 13 There's a missing piece that law, in fact, can 14 be enabling. Law does not need to be something that, 15 you know, that kills technology. That's just not at all 16 the right way to look at it. 17 I do think that information goods tags, when 18 we're talking about information goods, RFID tags I 19 really think we need to be considering that there have 20 to be limitations on what they can reveal and how easy 21 it is to get from a tag to databases that tell us what 22 people are consuming -- I hate to use that word -- in 23 relation to books and music. 24 With that, I will close.
25 MS. FINN: Thank you, Deirdre. For The Record, Inc. Waldorf, Maryland (301) 870-8025 163
1 The next person who we'll hear from is Dan 2 White. Dan has one of the more interesting job titles I 3 think I have ever encountered. He is a technical 4 evangelist, RFID, in technology for NCR's Corporation's 5 Retail Solutions Division. Dan's responsible for 6 evaluating RFID and other new technologies, determining 7 potential applications in the retail industry and 8 formulating strategic direction relating to these 9 technologies. 10 MR. WHITE: Well, as I've been sitting here 11 listening, I was thinking as a consumer, why would I 12 want RFID? What is the benefit to me personally? As I 13 look at it and I think about what might be going on in 14 the future, to get to the most basic level, RFID lets 15 you find things. So, I think about five years from now, 16 I might be sitting behind the TV looking at late night 17 TV and see an infomercial saying, buy this RFID tracker, 18 it will help you find your keys, it will help you find 19 the remote control that you're missing. It might even 20 help my wife keep track of the tools that she borrowed 21 so that I can find them after she borrows them. 22 As I was growing up, one of the things that 23 always amazed me was my mother, and she always bought 24 things on sale. Whether or not we needed them or not,
25 she bought them. In fact, one time she bought five For The Record, Inc. Waldorf, Maryland (301) 870-8025 164
1 boxes of corn flakes, and so we ate corn flakes for 2 seven days for breakfast, lunch and dinner, and as I was 3 thinking about the things she used to do, one of the 4 things she did was after Valentine's Day, she would buy 5 candy, and she would buy it for, you know, Easter or 6 Christmas. So, I don't know why as a child I always 7 wondered why the Easter bunny, you know, left me 8 Valentine's candy, but she did it because it was on 9 sale. 10 The problem came about was we never had enough 11 storage. So, she would end up hiding things. Number 12 one, she hid them so we wouldn't find it, but the other 13 reason was so that she could actually get to it when she 14 needed to. Inadvertently she would forget when she hid 15 them, and yes, one Christmas, I had Valentine's candy, 16 and we weren't sure which year it was from, so I still 17 check things when I go home and make sure the expiration 18 date's not gone, because she does seem to hide things. 19 So, whether it's something you've hidden in your home or 20 something that you may have lost, RFID in the future may 21 allow you as a consumer to be able to actually find 22 things that you're looking for. 23 If you take that concept into the store, and a 24 lot of that's been mentioned this morning, finding
25 things in the store is very critical. You may go For The Record, Inc. Waldorf, Maryland (301) 870-8025 165
1 shopping in a clothing store, and how many times are 2 things put in the wrong place? Being able to know where 3 it is at any one time in the store is powerful for the 4 retailer. It's powerful to let them know exactly where 5 it is at any one time. 6 If they're out of stock, like they've been 7 talking about this morning, they can go get more and 8 refill it, because the key thing in retail is if you 9 can't find it, you can't sell it, and from a consumer 10 standpoint, if we can't find it, we're not going to buy 11 it. That's why this is such an important technology to 12 the retailers. 13 If they're able to find it not only in the store 14 but all the way up the supply chain, you can imagine a 15 few years from now, you'd be able to go into a store, go 16 to a computer and say, I want this particular size in 17 this particular style of pants. They would tell you 18 exactly where it is, that it's in stock, and it might 19 even light up and say, "Here I am," so you don't have to 20 go through the rack of clothes. To me, that's a lot of 21 benefit. I hate going through a stack of clothing. 22 Looking forward, some of the things also, it's 23 not just finding things, but a lot of the benefits that 24 the retailers have been talking about are actually
25 lowering their costs. This was mentioned briefly, but For The Record, Inc. Waldorf, Maryland (301) 870-8025 166
1 if you look at the supply chain, it makes them more 2 efficient, and it means they can reduce their inventory. 3 All of these things ultimately will lower their costs. 4 It's not near term, it may be 10 years, may be 15 years 5 from now, but their lower costs will be passed on to the 6 consumer. So, from a consumer benefit standpoint, we're 7 going to be able to find things better, and we're going 8 to lower our costs. Those are some of the key benefits. 9 I think there's a lot of valid points that have 10 been brought about today, and as we start looking at 11 them and start having discussions about what are the 12 issues, I think we need to be very honest and open. 13 Some of the policies that have been put in place are 14 providing information in an open manner. We don't need 15 to hide anything. We need to say exactly what the 16 technology can do, and instead of being PR, we should be 17 also telling what some of the concerns are, and let the 18 consumer decide. 19 I think ultimately, the best benefit the 20 consumer can have is have the ultimate decision in 21 knowing what they want to do with the technology. 22 Thank you. 23 MS. FINN: Thank you. 24 We'll now hear from Sandy Hughes. Sandy serves
25 as the Global Privacy Executive or GPO at the Procter & For The Record, Inc. Waldorf, Maryland (301) 870-8025 167
1 Gamble Company. She also founded the Council of CPOs 2 for RFID Electronic Product Code Pricing Implementation, 3 and she's a member of the Public Policy Steering 4 Committee of the EPCglobal, and she's been active in 5 creating guidelines and is a speaker on the use of 6 item-level tagging. 7 MS. HUGHES: Thank you, Ellen, and thank you for 8 the opportunity to be here. 9 I hope some of you are familiar with Procter & 10 Gamble brands. We have over 300 in 160 countries around 11 the world, and we have 13 that have over a billion 12 dollars in sales each. So, if you look at this picture, 13 hopefully you use some of those. Can you tell me which 14 one is missing? It's the one that's out of stock 8 to 15 12 percent of the time. 16 For us, we are interested in EPC, as you've 17 heard, because for us, it's about putting the right 18 product in the right place at the right time and at the 19 right price. For us at Procter & Gamble, the consumer 20 is boss. That's a mantra that we carry throughout all 21 of our interactions, in everything that we do and what 22 we create, and the potential we feel for EPC is 23 throughout the entire supply chain, between us and our 24 suppliers, through the retailers, to the consumers,
25 through managing inventory, preventing theft and For The Record, Inc. Waldorf, Maryland (301) 870-8025 168
1 counterfeiting and reducing out-of-stocks. 2 Now, at Procter & Gamble, we are focused on the 3 supply chain. We haven't even begun to think about 4 what's going to happen post-sale for item levels that 5 leave the store, and for us, what's important, though, 6 is the way the consumer is feeling, because as I 7 mentioned before, the consumer's boss, and the way that 8 we manage the first moment of truth, what they see on 9 the shelf, really impacts whether they pick us up, they 10 continue with us, and continue as loyal consumers. 11 We have plenty of issues and things before we 12 are able to adopt EPC throughout our company. We are a 13 global company, and therefore, every solution that comes 14 up has to be a global solution, and this means across 15 all product categories and across all countries. In 16 technology testing, for example, we've heard about some 17 of the limitations when you think about liquids and 18 metals. So, in the testing that we have done, looking 19 at paper products, we have no problems with reliability. 20 You start to look at Pantene or liquid-filled items or 21 even our Cascade that has metal on the cases, on the 22 products, we have more difficulty. 23 But as I mentioned, we're looking at supply 24 chain, and we are able to pretty efficiently read
25 labels, tags on cases as they go sequentially down a For The Record, Inc. Waldorf, Maryland (301) 870-8025 169
1 conveyor belt, also on pallets, but when you get to 2 mixed cases on a pallet, we have a long way to go there, 3 and the cost is really important. If you think about a 4 99 cent can of Pringles and then putting that in a case, 5 when you get to some of the prices that we've seen for 6 tags in that whole process, it gets to be something that 7 we have a lot to work on. 8 The supply chain and internal adoption, within 9 our own four walls, we have incremental benefits, 10 because the state of our computer systems are pretty 11 efficient as they are. So, this requires collaboration 12 throughout the entire supply chain with retailers for us 13 to realize any additional benefits, and that means with 14 all retailers. We don't want to have a set of standards 15 and ways of doing things for one retailer versus another 16 retailer or in one country versus another country. So, 17 for us, being a global company with global processes, we 18 need a global solution, which brings us to the 19 standards. 20 We have heard some of the difficulties in, you 21 know, different countries, standards on spectrum, on, 22 you know, how the actual coding is done on the tags. We 23 are working very closely with EPCglobal on a number of 24 different task forces to come up with standards that
25 work across the whole broad range of issues for us. To For The Record, Inc. Waldorf, Maryland (301) 870-8025 170
1 have some products with EPC tags and some that are not 2 and different standards is just not cost-efficient for 3 us. 4 And then finally, public understanding. Even 5 though we are focused on the supply chain, we realize 6 from all of the research and some of the media articles 7 and the things from our own hands-on studies that show 8 that RFID is a concern to consumers. As I mentioned, 9 this is very important to us, and balancing the benefits 10 that they will get with solutions for privacy, health 11 and safety, et cetera, is really important to us. I 12 think the solutions are really going to be a combination 13 of technology, business processes, guidelines, 14 accountability, and we've been able to do that with our 15 consumer marketing. 16 Let me talk to you a little bit about our Global 17 Privacy Program. Our objective is to create an 18 environment of trust and confidence where consumers or 19 anyone that we do business with or collect personal 20 information from will willingly share their information 21 so we can better meet their needs. And if we want to 22 delight the consumer and have them be our boss, they 23 need to tell us what they want. So, we need to develop 24 that level of trust.
25 We have a global principle that we will treat an For The Record, Inc. Waldorf, Maryland (301) 870-8025 171
1 individual's information that they give to us as if it 2 were our own. We follow the fair information practices 3 of notice, choice, security, access, children, et 4 cetera, everything across the board in all countries, 5 whether there is legislation or not, and we also do it 6 across all media, so whether it's online, offline, 7 wireless and now RFID, and that is for across all 8 constituencies, whether it is consumers, consumer 9 marketing, consumer contact centers, employees, 10 shareholders, recruiting, et cetera, same principles, 11 same objective around the world. So, we need global 12 solutions. 13 Some of the successes we've had in this consumer 14 trust is that we have recently been voted by consumers, 15 over 6000 in the United States, as being the number one 16 consumer products company for ensuring consumer trust 17 and privacy. We were number three overall, behind ebay 18 and American Express. 19 The other thing is that a lot of people feel 20 that privacy policies and statements are not read on Web 21 sites and online. We have found this not to be true. 22 Over 4 percent of the hits to our pg.com are to our 23 privacy statement. 24 We are a permission-based marketing company, and
25 therefore, any further communication that we would have For The Record, Inc. Waldorf, Maryland (301) 870-8025 172
1 with a consumer is an opt-in basis. We have over 2 2 million subscribers who are providing their information 3 about their children to our Pampers newsletter so that 4 we can follow the development of their children. 5 A similar situation with our homemadesimple.com, 6 which is a program for making your work life balance 7 more efficient, where you share information with us and 8 we're able to provide products and services and tips for 9 you. We have less than 1 percent who opt out. So, we 10 have seen a number of successes, and I feel this will 11 happen with RFID as well as just a new technology to 12 consider for privacy. 13 How does that come together? We have on our 14 company Web site a privacy page where you can see our 15 policy, our privacy statement. We do have a short 16 notice up there, so you can go out and see it at a 17 glance under Policy. 18 We also have a position statement on electronic 19 product coding that says that we require notice whenever 20 tags are being used, choices for consumers, education, 21 and if there is any retailer or partner that we're 22 working with that would be using personal information 23 together with tags other than they do for bar codes 24 today, then we simply won't work with them if there is
25 going to be any type of item-level testing. For The Record, Inc. Waldorf, Maryland (301) 870-8025 173
1 We also have education, as we talked about, 2 which is very important for consumers, privacy news, and 3 the last thing is where we are actually testing the 4 technology. As I mentioned, it's pallet and case, but 5 in the example of the Wal-Mart test, where there is even 6 the potential chance that there could be a case that 7 would be on the floor, even though it shouldn't be, that 8 a consumer could buy, we have even gone to the extent of 9 labeling all cases, whether it could be on the floor or 10 not. So, we are not doing item-level testing, we are 11 not putting it there, but just in case it could be, we 12 have labeled every case. So, we go a little bit 13 overboard that way to ensure consumer trust and loyalty. 14 Thank you. 15 MS. FINN: Thanks, Sandy. 16 The last person on the panel is Bill MacLeod, 17 last but not least. Bill heads the competition practice 18 of the law firm of Collier Shannon Scott in Washington, 19 D.C. He specializes in antitrust, advertising and trade 20 regulations, and his practice ranges from the FTC to 21 Department of Justice, Congress and the courts, and 22 among other things, a variety of positions he has held, 23 he was the Director of the Bureau of Consumer Protection 24 here at the FTC from 1986 to 1990.
25 MR. MacLEOD: Well, thank you very much. Thank For The Record, Inc. Waldorf, Maryland (301) 870-8025 174
1 you for having me here today. 2 I thought it would be a good opportunity now at 3 the end of this session for me to wrap up with a couple 4 of observations, both about the promises and about the 5 concerns for RFID. We've heard a lot of both, and I 6 think we're here at the ideal setting to the consumer 7 for both, because what we are talking about as far as 8 the promises are concerned is whether the marketplace is 9 going to accept RFID, whether the marketplace is going 10 to acknowledge that the benefits of RFID outweigh the 11 costs. 12 We've heard a lot of potential for how those 13 benefits can, indeed, deliver new value throughout the 14 supply chain and perhaps beyond. The ultimate test for 15 that is not going to be decided here, of course. It's 16 going to be decided out there in the marketplace when 17 companies do determine that the benefits of RFID do, in 18 fact, outweigh the costs. 19 Where are the concerns coming in? The concerns, 20 of course, are concerns about consumer protection, and 21 that brings us back here again to the Federal Trade 22 Commission, the federal agency primarily concerned with 23 consumer protection in the United States, and the beauty 24 of being here at the FTC is we have the agency not only
25 that covers consumer protection, but the agency that For The Record, Inc. Waldorf, Maryland (301) 870-8025 175
1 appreciates the need for the marketplace, to sort out 2 the winners from the losers. 3 What I find especially disconcerting perhaps 4 about the conversation so far today is a 5 misunderstanding of how the FTC law and FTC law 6 enforcement has evolved over time. We haven't heard it 7 directly from the panelists, but we have seen a lot of 8 literature and a lot of releases to the effect that we 9 are sailing without specific protections here. We don't 10 have any laws in place yet with the words "RFID" 11 encoded, and what does that mean for consumers and 12 whether or not they will be protected from the new 13 forces that this technology will unleash? 14 Well, the answer from the FTC standpoint, at 15 least if the FTC approaches this as it has approached 16 most things in the last 90 years of its existence, is 17 that you don't need "RFID" drafted onto Section 5 for 18 the Federal Trade Commission to protect consumers from 19 potentially unfair or deceptive practices that could 20 occur as a result of RFID. 21 The Federal Trade Commission has been protecting 22 consumers from deception and unfairness since before 23 we've had TV, almost before we had radio. Section 5 was 24 not amended when radio came along. It was not amended
25 when TV came along. It was not amended when computers For The Record, Inc. Waldorf, Maryland (301) 870-8025 176
1 and email and everything else came along. Certainly 2 there have been some specific statutes enacted in the 3 past and some regulations the FTC has adopted to deal 4 with particular aspects of emerging technologies, but by 5 and large, you will find the FTC enforcement in most 6 consumer protection to stem from the basic protections 7 of deception and unfairness, and privacy is no 8 exception. 9 Much of the privacy agenda at the FTC developed 10 after I left. I had the fortune or misfortune, as my 11 client might think of it, of defending one of the first 12 cases the FTC brought for privacy protection involving 13 children. I won't mention the name of the client, for 14 which I am sure I will be appreciated, but the issue was 15 this. It was the releasing of personally identifiable 16 information or at least the making available, whether it 17 was released or not, of personally identifiable 18 information, and the FTC proceeded on the basis of its 19 deception doctrine because the company had a policy in 20 place already that said we will not share, make 21 available or otherwise release personally identifiable 22 information about the children who visit our Web site. 23 That very policy has informed most of the law 24 enforcement cases we have seen so far, whether it is a
25 violation of a stated policy or especially if you go out For The Record, Inc. Waldorf, Maryland (301) 870-8025 177
1 into the states and into the class actions, you will 2 find violations of unstated policies, failures to 3 disclose that information has been made available or has 4 been shared with other marketing partners. These cases 5 have been brought by the Federal Trade Commission, other 6 consumer protection agencies and plaintiffs' class 7 action lawyers without the need for a single additional 8 piece of legislation. 9 The RFID I think will present something very 10 little different as far as the protections that we need 11 to see and at least as far right now as we can see of 12 what the technology is promising us today. The consumer 13 implications of RFID are pretty clear from the 14 presentations we've heard today. It has the potential 15 to lower costs. That is a potential that can be worked 16 out very readily in the marketplace between retailers 17 and suppliers, something the consumers will simply 18 benefit from as a result of the marketplace delivering 19 those costs through competition in the form of lower 20 prices to consumers, but what will happen if and when 21 some of the concerns we are hearing about come up? 22 My suggestion to you is that the first line of 23 defense will once again be the Federal Trade Commission, 24 as it has often been in the past, in applying its
25 Section 5 authority and stopping a company from For The Record, Inc. Waldorf, Maryland (301) 870-8025 178
1 violating its publicly stated privacy policy, stopping a 2 retailer from violating its publicly stated privacy 3 policy, and you can probably bet that there will be 4 Federal Trade Commission cases, if not class actions and 5 state attorney general cases, against abuses of RFID 6 technology long before there is ever a law that mentions 7 RFID. 8 I remember in one of my prior jobs before I was 9 here at the Bureau of Consumer Protection at the FTC, I 10 brought a case against a manufacturer of cable decoders, 11 pirate cable decoders, using the unfairness authority of 12 the FTC. It was a somewhat controversial case here at 13 the FTC, because it was a novel application of the 14 unfairness jurisdiction, but no one said to me, Bill, 15 the FTC Act doesn't say anything about cable decoders. 16 It doesn't have to. Unfairness and deception or to 17 protect consumers from unfair deceptive acts and 18 practices, whether it's computers, decoders, books, 19 information goods, consumer product goods, it doesn't 20 matter. The Federal Trade Commission Act can protect 21 us. 22 How many of these concerns do we ultimately hear 23 will ultimately become realistic concerns? I don't 24 know. Some of these remind me of the comment that one
25 of our famous presidents, not President Reagan, once For The Record, Inc. Waldorf, Maryland (301) 870-8025 179
1 said about his economists. "I remember this economist, 2 he predicted nine of the last five recessions." There 3 are undoubtedly going to be some concerns that we need 4 to take into account, but we need first to identify 5 which ones are realistic and which ones are not. 6 I think you all might have seen the stories over 7 the last couple of days of these new private companies 8 that are about to launch people into space. I don't 9 think we have to worry yet about getting a conference 10 together to determine whether or not they are going to 11 sell tickets fairly and at reasonable prices. That's 12 getting a little bit down the road. 13 Why don't we similarly wait here and find out 14 whether there is going to be a concern that legitimately 15 arises as this technology develops and then ask the 16 question whether this is a concern that is a concern 17 that cannot be addressed with the application today of 18 unfairness and deception under the FTC Act, and then we 19 will know the answer to the question whether or not we 20 need a legislation or a regulation that says, "RFID 21 needs to be regulated the following way." 22 I can tell you one thing both from my experience 23 as a regulator and my experience defending people 24 against regulators. I have yet to find a target of an
25 FTC action and I have yet to find a client of my own who For The Record, Inc. Waldorf, Maryland (301) 870-8025 180
1 thought that a law was enabling, was a freedom-giving 2 experience. When someone gets sued for violating a law, 3 I guarantee you that is a restriction that stops 4 activity. If that activity is the activity you did not 5 mean to stop, the law was a mistake. Let's let the law 6 develop where and when we know it needs to be developed. 7 Thank you very much. 8 MR. LIVINGSTON: Okay, that completes our 9 comments and presentations. If any of you have 10 questions, there will be people from the FTC coming 11 around picking them up. 12 While we're waiting for those, I have a couple 13 of questions I'd like to ask, actually a couple of 14 conundrums that I'd like to explore with the panelists. 15 The first one is really for anyone, but maybe 16 Mallory and Beth and Bill could comment on this one. 17 Everyone we've heard from today agrees that item-level 18 tagging of most consumer goods is ten years away or 19 maybe even more, yet RFID is a consumer issue and some 20 would even say a high-profile consumer issue today, as 21 reflected in media coverage. It's really a two-part 22 question. 23 If there is a disconnect between these two 24 pieces of information, why, and probably more
25 importantly, what can or should industry, government, For The Record, Inc. Waldorf, Maryland (301) 870-8025 181
1 advocacy groups and others do to bridge the gap between 2 reality and perception? 3 MS. GIVENS: Well, I think that's why I'm so -- 4 why I recommend that a formal technology assessment akin 5 to what the Congressional OTA used to do is so 6 important. I think we should, as experts, be looking 7 ahead. 8 I disagree with Mr. MacLeod saying let's wait 9 for the problems and then figure it out. I think, you 10 know, we're experts here. Let's take a look at things 11 that we've experienced throughout the years and maybe 12 apply some of the lessons to what we see as really a 13 revolutionizing technology, a technology that obviously 14 has tremendous benefits for many people in society, yet 15 as I said, like a classic information technology, it 16 also has that downside, something that needs to be 17 mitigated, and I think by some decent analysis and 18 planning and surveys that are done -- I think we need 19 more research that's done by impartial bodies so we can 20 get a sense of what consumers really are thinking about 21 this. 22 So, I think we should really look ahead with all 23 the knowledge that we have and the experiences we've 24 gained over the past and try to mitigate the potentially
25 bad things that could happen. For The Record, Inc. Waldorf, Maryland (301) 870-8025 182
1 MR. DUNCAN: If I may, the honest answer I 2 believe is that because people like to dream, you could 3 look back at Jules Verne, look at the old Buck Rogers 4 serials, and lots of fantastic inventions were thought 5 of 50 or 100 years before their time, and yet none of us 6 would think, let's go out and regulate, make sure that 7 doesn't happen. 8 I mean, the fact is, this is a relatively new 9 technology. In people's minds, it's very open-ended. 10 It's, in fact, technologically quite limited. So, we 11 need to find what the technology can actually achieve 12 before we put the brakes on. 13 MR. LIVINGSTON: Anyone else down there want 14 to -- 15 MS. MULLIGAN: Actually, if I could, I just want 16 to build off of Beth, you know, that this is the time to 17 think about it. You know, misinformation and myths 18 flourish when there is not an adequate record, and I 19 think this particular proceeding is a really important 20 part, but I think, if anything, as information begins to 21 trickle out, unfortunately, I hate to say this, but you 22 know, I believe Ken Fishkin came and gave us this really 23 cool, "the invisible man," and I can just imagine some 24 of the stories that are going to happen, you know, Intel
25 is going to place chips in everything, right, and you For The Record, Inc. Waldorf, Maryland (301) 870-8025 183
1 know, that's not what I'd want to see happen to it, but 2 in the absence of kind of big thinking, deep thinking, 3 people are anxious, and when people are anxious, you 4 know, you get stories, some of which are crazy and some 5 of which are, you know, dreaming, and some dreams come 6 true. 7 But I also wanted to say that, in fact, industry 8 has supported legislation in areas and they have viewed 9 it as enabling. I would say the E-Sign Act would be an 10 example, I would say the Electronic Communications 11 Privacy Act. There have been numerous areas where 12 industry has decided that privacy legislation would, in 13 fact, be enabling of technology, and some of your 14 clients I guess are supporting that legislation, because 15 some of the biggest technology companies I know of did. 16 MR. MacLEOD: Let's talk for just a second about 17 the need for impartial bodies. Obviously we have a 18 great ability here hosted by the FTC to have some folks 19 that are partial about the technology and partial 20 against the technology, letting the marketplace of ideas 21 work out what is the best and what is not so good as far 22 as RFID is concerned. There's nothing wrong with 23 partial bodies. 24 What if we had an impartial body at the time
25 that VHS and Betamax were fighting it out and the For The Record, Inc. Waldorf, Maryland (301) 870-8025 184
1 impartial body had picked Betamax? The marketplace is 2 the best place for us, first of all, to determine which 3 is the best technology, and then it's going to be the 4 job of the sponsors of that technology to sell it to 5 consumers, and if they fail, the consumers are going to 6 abandon them, and we are not going to have to worry 7 about any sort of legislation about RFID, because 8 consumers won't want it. The marketplace first has to 9 decide, and then we can determine whether or not there's 10 something more for the legislators to decide. 11 MR. LIVINGSTON: Okay, here's another possible 12 conundrum, and I'll address this one to Dan and anyone 13 else who wants to talk to it. 14 It seems that a flash point for RFID relates to 15 how the data is collected. There's a fear that it will 16 be collected automatically and without the consumer's 17 knowledge. Is this really the crux of the issue, or is 18 it what is done with the data regardless of how it is 19 collected? 20 MR. WHITE: If you're looking at EPC tags today, 21 it's been stated it's just a number. I really think -- 22 and Beth mentioned this -- I think one of the key areas 23 we really need to look at is what you do with the data 24 and how do you manage that.
25 If it's actually captured and nobody can For The Record, Inc. Waldorf, Maryland (301) 870-8025 185
1 associate that with anyone, there may be some concerns, 2 but I think most of them probably go away. So, making 3 sure the data is secure, that if there is any way to 4 associate that with an individual, that that's managed 5 in a way nobody can get at it that shouldn't, and 6 putting in the protections for the consumer there. 7 I think there's a lot of discussion that needs 8 to happen there. A lot of it's already occurred in 9 other data management type situations, but we may be at 10 another level now that we're talking about being able to 11 track after the fact. 12 MR. LIVINGSTON: Any other comments on that 13 question? 14 MR. PARKINSON: To a large extent, this isn't 15 just about a technology. It's about the technologists. 16 There's a lot of things that we can do today that we 17 don't do because there is no profit in it. The market 18 won't allow profitless services to develop for very 19 long. 20 One of the threshold factors around RFID, 21 there's a technical challenge for us, is what do we do 22 with all the data? Not good things or bad things, just 23 do with it? A fully instrumented economy today would 24 generate 30 terabytes -- to use a technical name for a
25 lot -- of data every day. We don't have any place to For The Record, Inc. Waldorf, Maryland (301) 870-8025 186
1 put that today. 2 So, what we're going to do with it likely, what 3 we did with credit card information when that system 4 first started, we are going to throw most of it away, 5 and most of it isn't very interesting. Most of it's 6 picked up, dropped off, okay kind of data. Only when it 7 gets to the customer interface and we can actually start 8 associating across databases does a major concern arise, 9 at least from my perspective, and that is a very 10 technically challenging thing to do today, except in 11 special cases, and to do it generally probably is beyond 12 our ability to afford for quite a long time. 13 So, it's always difficult to generalize from 14 proof of capability pilots into general deployment, and 15 what's really challenging everybody today is figuring 16 out how to perform general deployment, even if 17 competent. 18 MR. MacCLEOD: There is a capability today and 19 the information exists today that someone can make a 20 great deal of money selling. Every time I shop at 21 Safeway, every time I shop at CVS, I run my membership 22 card through the scanner. Safeway and CVS know a whole 23 lot about my habits, and I guarantee you if they try to 24 sell that to anybody, that is almost certainly going to
25 get out, and there are a number of law enforcers in this For The Record, Inc. Waldorf, Maryland (301) 870-8025 187
1 room who will give them the misery of their corporate 2 lives, and what RFID is doing is simply providing a 3 different way of gathering information that can be 4 misused or can be used properly just as the information 5 that is being gathered today. It is the conduct that we 6 have to worry about, and it is the conduct that is 7 already being protected by the privacy policies 8 announced by retailers and by the law enforcers and by 9 the plaintiffs' lawyers who will make it very painful on 10 anybody who violates those promises that they have made 11 to consumers. 12 MS. FINN: I'd like to ask a question, and maybe 13 Beth and Sandy, you'll want to comment on this or 14 anybody else who wants to jump in. 15 We've heard a lot about the supply chain and a 16 little bit less about some of the item-level tagging 17 applications and what that may mean for consumers and 18 some of the applications that may benefit them if they 19 leave these tags enabled, you know, along with 20 presenting in terms of, you know, monitoring something 21 that you want to take, to raise the possibility of 22 tracking stolen items, and we may hear more in later 23 panels this afternoon about what the future might hold. 24 To the extent that people are talking about
25 notice to consumers and choice about whether or not to For The Record, Inc. Waldorf, Maryland (301) 870-8025 188
1 kill tags, because there might be these applications 2 that would be of interest to them if they leave the tags 3 active, I'm wondering if you could sort of think out 4 loud for me what that kind of notice and choice regime 5 would look like and what kinds of burdens it might 6 impose on consumers. 7 For example, are we going to get privacy 8 policies where we have to make kill choices every time 9 we go to the grocery store or the office supply store or 10 a clothing store on an item-by-item level basis? Can 11 you give us a sense of how you envision the notice and 12 choice sorts of protections working? 13 MS. HUGHES: Well, I can start. You know, we 14 already have some guidelines in place that really deal 15 with the technology the way it is today, and basically 16 that's giving the choice to the consumer and notice on 17 the products. So, I mentioned before, for example, that 18 we are putting tags on our cases, you know, just for the 19 chance that it could actually end up in a consumer's 20 hands, even though that's not our intent. 21 I think that that will probably continue to 22 evolve as we get more education out there, where 23 consumers start to know that when they see the EPC 24 symbol that's on a product, just as they would, you
25 know, "kosher" or "recyclable" materials, that they For The Record, Inc. Waldorf, Maryland (301) 870-8025 189
1 would want to know what that is, but that's a huge, 2 massive education campaign to be able to get to that 3 point. 4 As far as choices, I think as the technology 5 starts to develop, you know, there will be all different 6 kinds of things that could be possible. It might be, 7 you know, a vision that people see for the future, is 8 that all your products are tagged, they will be in a 9 smart cart, and you can just kind of walk out, you know, 10 because it will know what your purchases are, and you 11 put your loyalty card in there, your credit card, you 12 know, you don't even need to talk to anybody or see 13 anybody. 14 That's really far off, but it might be that 15 there would be some sign that would come up, you know, 16 to the consumer as they're putting in their loyalty 17 card, or let's say even through like a "you-scan," that 18 says, "Do you want your tags killed or not," or 19 something like that, and then it just automatically does 20 it when it scans the tags, and there is no intervention 21 required at all. I mean, that could be a solution. 22 It's a process as well. 23 There are also guidelines that may need to be 24 put in place. So, it's not all technology, and it's
25 something that could be self-regulated as well. For The Record, Inc. Waldorf, Maryland (301) 870-8025 190
1 MS. GIVENS: Yeah, and I brought something with 2 me, I'm so glad you asked this question, because now I 3 can do my show and tell. This is a TrackPhone package, 4 and I am quite certain it has an RFID tag in it. It's 5 right next to the magnetic theft protection device, but 6 I'm pretty sure that's RFID. 7 What I would do with this, just from a -- I 8 guess one of the things that we do as the Dear Abby of 9 privacy is we also try to quash conspiracy theories when 10 people call us and ask us, is such and such really true? 11 What you could do here is just put a red dotted line 12 around it that says, "EPC tag" or "RFID tag," and if 13 it's something that the individual kept live and wanted 14 to keep for warranty or to attach to their receipt if 15 they needed to return it, they could cut it out, put it 16 in a little mylar sack and store it. 17 I mean, I think probably I'm a little bit of an 18 unusual consumer in that I'm a consumer advocate by 19 profession. I do keep receipts. I do know about the 20 fact that you don't have to keep things like this or the 21 product registration cards that you get in the packaging 22 to return an item, but there are some things that I 23 think that the industry could do to reduce the 24 conspiracy theory problems, and that would be clear
25 labeling, and also, never, ever, ever embed an RFID tag For The Record, Inc. Waldorf, Maryland (301) 870-8025 191
1 in clothing, in shoes, in one's eyeglasses, in anything 2 that is worn or carried by the individual, and I agree 3 with Lee Tien, that includes driver's licenses and 4 passports. But I think just clear labeling, enabling 5 individuals to destroy them if they want to, keep them 6 if they want to, of course, kill them if they want to. 7 The other thing is I think individuals should be 8 able to have their own readers or go someplace where 9 they can read what they have on their person or what 10 they think they have. 11 I think those are the extent of my comments. I 12 think there's a lot of things, though, that industry can 13 do to allay suspicions and fears, and labeling is a big 14 one. 15 MR. LIVINGSTON: Okay, this is for John and 16 Sandy. Was the RFID consumer study, the Capgemini 17 study, peer reviewed and published in a reputable 18 research journal? Can other researchers get a copy of 19 the methodology used so they can attempt to replicate 20 it? I ask because previous studies conducted by the 21 Auto-ID Center, including one done in conjunction with 22 Procter & Gamble, found that consumers were very opposed 23 to RFID on both privacy and health grounds. 24 MR. PARKINSON: So, it was not a peer-reviewed
25 study, was not published in any kind of formal journal, For The Record, Inc. Waldorf, Maryland (301) 870-8025 192
1 reputable or not, but it is published by us, and the 2 protocol was actually done by a third party to a design 3 that we co-developed, and the protocol is published. 4 So, what questions we asked, what was directed, 5 what was undirected and so on is available, and we are 6 happy to open all that up so anybody else can replicate 7 it on a different population. For economic reasons, we 8 are a business, not a research organization, so for 9 economic reasons, we limited the panel size to a 10 statistically valid profile. So, we did take account of 11 gender, income, geography and education to the extent 12 you can in a small sample survey. 13 It was just over a thousand respondents when the 14 survey was cut off. The results have statistically 15 meaningful inferences, but if you did the study a 16 thousand times, you would get a distribution of results 17 that would deviate somewhat from the percentages that 18 we've produced, not necessarily in our view by very 19 much. 20 MS. HUGHES: And I can talk about the research 21 that was done by the Auto-ID Center, and it wasn't done 22 by P&G, but we let them use our services since we are 23 pretty good at doing market research by consumers, the 24 number of tools that we have available, and one of the
25 outcomes from that study as we did find out how For The Record, Inc. Waldorf, Maryland (301) 870-8025 193
1 consumers perceived the technology is to implement from 2 the Auto-ID Center the Independent Advisory Council 3 that's been led by Elliot Maxwell, who you will hear 4 from later today. So, that was a direct action that 5 came from research that was done by the Auto-ID Center 6 and a number of the members of Auto-ID Center where we 7 saw that there were concerns from the consumer sector, 8 and we did something about it. 9 MS. FINN: Thank you. 10 Another question from the audience, has the 11 regulation of RFID already begun? Is this workshop a 12 sign that it's begun? And at the state level, seven 13 RFID bills were introduced this year in five states. Is 14 this a good thing or a bad thing? 15 I am going to answer part of this question, is 16 this workshop a sign that regulation has begun. The 17 answer is no. From the FTC's perception, we often have 18 these workshops, and they are not a precursor to 19 regulation. 20 But as to the other aspects of state regulation, 21 maybe Bill and/or Deirdre would like to speak to that. 22 MR. MacLEOD: Well, I think it is probably 23 premature to say that RFID regulation has begun, but it 24 would also be misleading for the reasons I've stated
25 before, and that is RFID is a very well-defined problem For The Record, Inc. Waldorf, Maryland (301) 870-8025 194
1 in the consumer protection space, the consumer 2 protection agencies recognize, and they will address it 3 if RFID becomes in any way misused to the detriment of 4 consumers. 5 So, once again, we don't have to have an RFID 6 bill or an RFID regulation by either a state or the 7 Federal Trade Commission, but I can guarantee you -- and 8 I can do this because I no longer work at the FTC and I 9 don't have to qualify my promises -- if someone uses 10 RFID to start disseminating personally identifiable 11 information contrary to their privacy policies, they're 12 going to have the FTC all over them. They're going to 13 have the states and they're going to have plaintiffs' 14 lawyers as well. In that respect, RFID is indeed 15 regulated, and it's the kind of regulation that we 16 should welcome. 17 MS. MULLIGAN: You know, certainly there are 18 state efforts to regulate RFID, primarily, kind of in 19 the consumer marketplace. I think that probably what 20 you got from the opening panel was that the use of RFID 21 spans lots of different markets and has lots of 22 different implications regarding privacy, and you know, 23 the kind of legislation or the kind of self-regulatory 24 guidance that you might develop in the Procter & Gamble,
25 you know, EPCglobal commercial space would be I would For The Record, Inc. Waldorf, Maryland (301) 870-8025 195
1 imagine quite different than what you might see 2 developed for the invisible man, and so my guess is 3 that, you know, we're going to continue to see, as we 4 always do, legislation that, you know, is kind of 5 brought about by the latest article in the newspaper. 6 My hope would be that while the FTC may not be 7 looking to regulate, this is at least part of the 8 beginning of a dialogue about how to institute best 9 practices, how to develop public policy. Whether or not 10 that public policy has a heavy regulatory component I 11 think is a separate question. 12 MR. LIVINGSTON: Okay, I have two questions here 13 which are related I think, so I'll ask them both, and I 14 guess Sandy and Mallory and anyone else, of course. 15 We've heard that EPC/RFID tags will cost 20 16 cents to $20 and a reader is $500 to $1,000. For the 17 billions of cases of products moving through the supply 18 chain, who is paying these costs, i.e., a $10 item with 19 a 25 cent tag is now going to cost $10.25? How is the 20 consumer saving? That's one approach to this same 21 question. 22 The second one is, I've heard that Procter & 23 Gamble spends $3 billion in the supply chain every year 24 getting products to the customer and can potentially
25 save $1 billion by using RFID. Will consumers ever see For The Record, Inc. Waldorf, Maryland (301) 870-8025 196
1 a reduction in prices from this kind of corporate 2 savings? 3 MS. HUGHES: Well, overall, the whole supply 4 chain is involved in the savings. You mentioned the 5 savings, but you don't talk about the cost that goes 6 along with it. So, we're still working on a business 7 case that would come about, but the end result is that, 8 yes, we're doing it for consumers. I mean, that's the 9 reason why we're there, as I mentioned before, we have 10 the product they want on the shelf when they want it at 11 the right price, and that all goes together. 12 So, it's not just price-oriented itself, but 13 it's the whole shenanigans, the whole thing that you see 14 on the shelf, the first moment of truth, are we meeting 15 what the consumer wants or not? 16 MR. DUNCAN: And Ted, I guess because you were 17 asking two questions, one was really an apple and the 18 other was an orange. The first one was really talking 19 about I think the expensive tags that are used at the 20 pallet level, and there the savings are spread across 21 the entire pallet, and it's much more significant than 22 the same tags used at the item level. 23 As to whether the savings is passed onto 24 consumers, the honest answer is people can't expect to
25 see a dollar-to-dollar pass on of savings, because a For The Record, Inc. Waldorf, Maryland (301) 870-8025 197
1 dollar saved, you won't see a dollar more, because 2 retailers don't compete that way. The way we compete is 3 by taking whatever it is they do best and trying to 4 deliver that as an incremental value to consumers. 5 For example, Neiman Marcus and Saks don't 6 compete by offering $25 off on the merchandise they 7 sell. They compete by having the kind of sales force in 8 the store that consumers who shop there want to see 9 there. That's a very different model than, say, 10 Wal-Mart, which is trying to shave every cent off. So, 11 yes, there will be savings, but they will appear in a 12 different form. 13 MS. HUGHES: And just to qualify some of the 14 numbers there, for us, at case and pallet even, you 15 know, we've said that it needs to be done at 5 cents a 16 case. So, we are way far away from that, and if you 17 consider any further down to item level, as I mentioned 18 before, you know, some of the prices of our products, 19 there need to be, you know, some really major savings to 20 offset the costs so that we can even, you know, provide 21 the same price, or we just won't do it for consumers. 22 As I mentioned, it's the whole delivery to consumers 23 there. 24 MS. FINN: Another question is, have any of you
25 determined whether database collection of RFID data For The Record, Inc. Waldorf, Maryland (301) 870-8025 198
1 linked to an identified individual violates European 2 privacy law, and how do you get meaningful consent to 3 linkages like that with such low levels of consumer 4 awareness? It didn't specify who should answer, but if 5 anyone wants to volunteer... 6 MR. PARKINSON: Okay, so I work for a European 7 company, so this is something we worry about every day. 8 The fact of linkage does not violate European law. It's 9 what you do with the linked data afterwards that puts 10 you at threat, and there are gray areas here that the 11 legislation was not designed to deal with, particularly 12 the movement of goods which carry information with them 13 across national boundaries, which in some 14 interpretations is just by itself illegal without the 15 consent of the carrier, which could be an individual. 16 When the original privacy legislation was 17 written, nobody had thought of that. So, we expect to 18 see some evolution of practice and policy leading to 19 evolution of legislation in Europe. It gets even more 20 complex when you cross territoriality, because it's just 21 as easy for me next week when I'm going to be in Paris 22 to pick something up which could be tagged and legal in 23 Europe, fly back to the United States, and have it 24 tagged and illegal. So, this is not just a North
25 American problem. The supply chain is global. For The Record, Inc. Waldorf, Maryland (301) 870-8025 199
1 Seventeen percent of everything that you buy is 2 made in China these days, and it's on a rising trend. 3 So, we have to start thinking about what are we going to 4 do to harmonize our point of view about acceptable 5 practice on a global scale, and consumers are going to 6 be everywhere, and they can buy goods no matter how 7 marked. 8 You might, for instance, want to think about 9 perfectly valid market legislation which requires you to 10 learn Chinese in order to know what was marked. Those 11 are the types of issues that you start to look at when 12 you look at it on a global scale. 13 MS. MULLIGAN: I haven't looked specifically at, 14 you know, how the European Union Data Protection 15 Directive would map onto RFID, but I do think, you know, 16 when you talk about pushing data out to the end points, 17 we've focused before on kind of distributed computing, 18 and you know, there are some very difficult questions. 19 So, for example, to the extent that -- when you 20 take the library as an example, in order for somebody to 21 access information at the library, they have to come 22 with a subpoena, but now they could, in fact, 23 reconstruct it, because there is some information on the 24 book that allows them to kind of easily assemble that.
25 Would it be in violation of the state law? For The Record, Inc. Waldorf, Maryland (301) 870-8025 200
1 You know, I don't know what it would look like, 2 but you have kind of the question about how does this 3 impact with kind of the general public policy framework 4 that we've put out there, and these kinds of, you know, 5 cheap, inexpensive broadcast technologies that 6 potentially store information that you can connect to 7 other databases or that is a pointer to a database, and 8 you add in some stuff that hasn't been talked about yet 9 today, the EPC object name server and the EPC discovery 10 service that are about kind of tracking a particular 11 good as it moves out of all these distributed points, 12 whether it's with readers, or enabling you to find a 13 point or two database that gives you more information, I 14 think there's lots of questions about how our general 15 privacy framework, which really was developed in the 16 time where there were very specific data collectors that 17 had the information and nobody else did, it was 18 centralized, they had kind of responsibilities, and 19 these kinds of systems really start to pull at that kind 20 of framework. 21 MS. HUGHES: And let me just pick up on what 22 John was saying about the EU. For us, and I mentioned 23 this before, being a global company, we source globally, 24 so product made in one country we will source to
25 another. It's really important for us to have global For The Record, Inc. Waldorf, Maryland (301) 870-8025 201
1 standards, and this is for everything, you know, from 2 the technical aspect as well as privacy, and you know, 3 the European Union is kind of, you know, still trying to 4 decide how they feel about RFID, and we're working with 5 them as well. 6 So, you know, as much as we appreciate forums 7 here, we're doing the same thing in Europe, and we will 8 be doing the same thing in other regions as well, so we 9 come out with some common solutions, but within Europe, 10 for example, some countries can't agree on whether it 11 falls under the current EU Directive or whether it 12 doesn't, et cetera. So, there's a lot of work that 13 needs to be done there on all fronts. 14 MR. LIVINGSTON: Okay, here's one for Beth. 15 We've heard today that there are consumer RFID 16 applications -- drugs, meat and tires come to mind -- 17 which can save lives but require an item-level tag. In 18 many cases the consumer benefit is enhanced if tags 19 remain after sale. Does the position statement on the 20 use of RFID on consumer products which your organization 21 has co-sponsored and which calls for a voluntary 22 moratorium on the item-level tagging of consumer items 23 apply to these categories? 24 MS. GIVENS: Well, the position statement, which
25 you could read at privacyrights.org and also For The Record, Inc. Waldorf, Maryland (301) 870-8025 202
1 spychips.org and some other Web sites, has a couple of 2 attachments to it. One of the attachments is a 3 discussion of RFID applications that would be considered 4 beneficial and would not be problematic to the 5 individuals and organizations that signed onto that. 6 But I want to return to something I said 7 earlier. I think some benefits can come from not 8 necessarily EPC tagging, where there's a unique 9 identifier for each can of Coke, but as I mentioned, 10 there's certain types of tagging that could be generic, 11 for example, that identifies a toxic. It could just 12 say, this is lead, this is nickel cadmium, when you take 13 it to the landfill. 14 So, I think that when we're looking at the 15 privacy impacts and the solutions for mitigating some 16 privacy threats, I think we could look at different ways 17 of implementing RFID that don't necessarily uniquely 18 identify that item that is then held by that individual. 19 So, I think there are lots of kind of creative things 20 that can be done that mitigate the privacy impacts or 21 the potential privacy impacts. 22 MS. FINN: I have another question, and Dan, 23 maybe you can answer this or anybody else who thinks 24 that they -- maybe it's a little more technical.
25 Right now, in terms of the possible solutions For The Record, Inc. Waldorf, Maryland (301) 870-8025 203
1 that might help consumers, we have heard a lot about 2 kill functions. Does killing RFID tags have to be all 3 or nothing? To the extent that there's a potential for 4 beneficial uses of tags remaining on, is there a way to 5 have tags not be so promiscuous, to allow consumers to 6 leave them on but only to be read by authorized readers? 7 MR. WHITE: There have been several things 8 talked about in the industry, in fact, we talked about 9 within our company about a couple ways to do it. One 10 mechanism kind of goes along with what Beth is saying, 11 is just killing the serial number and leaving the 12 product code and manufacturer code live. We talked 13 about ways of just tying into a transaction, maybe 14 rewriting the code, and it's no longer individual items. 15 There's also some IP that we have put in about 16 disabling the tag for range and maybe kind of shooting 17 it in the leg so you can't read it more than an inch 18 away or you actually have to have it up against 19 something to read it. So, there are multiple technical 20 possibilities as we look at this in the future that are 21 beyond just killing it. 22 Killing may be what we want to do right now, 23 just because we want to work through a lot of the other 24 issues before we really address it, but there are a lot
25 of different ways to solve the problem, where someone For The Record, Inc. Waldorf, Maryland (301) 870-8025 204
1 couldn't read it if they didn't want to. You can 2 encrypt the thing where you have to have a certain 3 reader in order to actually read the tag, a lot of 4 different things that the consumer might be able to use 5 in the future. 6 MR. DUNCAN: I think we have to be really 7 careful when we talk so promiscuously about the idea of 8 killing technology, because the unintended consequences 9 of that run deeply as well. We've talked a lot about 10 the imagined consequences from the privacy perspective, 11 but in terms of trying to develop new markets for these 12 products, you want the products to have a life so that 13 those markets can develop. 14 For example, I mean, one of the not very far 15 outside ideas, we demonstrated this at the NRF show this 16 year, was the smart refrigerator and the idea that if 17 there is sufficient demand for it, there can be products 18 within the refrigerator that can read the products 19 there, the other merchandise, and let you know whether 20 or not the milk is out of date, whether or not you're 21 low on certain normal staples, and have a possibility of 22 having the refrigerator re-order for you, yet no one's 23 going to go to the trouble to develop that kind of 24 technology if a significant proportion of the public is
25 going to say, we ought to kill this without having a For The Record, Inc. Waldorf, Maryland (301) 870-8025 205
1 good reason to kill it. So, I think we have to keep in 2 balance the benefits and the costs. 3 MR. PARKINSON: And you have to remember that 4 the architecture for deployment we're working with today 5 means that the tags are dumb. What you get off the tag 6 is a bit stream. It doesn't mean anything. It's just a 7 number, and unless you know how to decode the first 8 eight bits of the stream, you don't even know what kind 9 of number it is. Without being able to hit a reference 10 server, an object name server, to find out what that 11 stream means, all you've got is a bunch of numbers. 12 The controls -- we could encrypt those so that 13 they don't even mean directly what they mean when you 14 individually manage to decrypt them. Control of the 15 object name servers and how you get to the intelligence 16 that tells you what that stream means should be the 17 primary place to start applying policy, because that's 18 an easier, at least for now, form of control. 19 Long term, we can build scenarios that will put 20 all that data eventually into the public space, because 21 with enough cheap computing and cheap storage, you can 22 reverse-engineer the content of the object name servers 23 into public versions, just like you can now with CDs and 24 movies. But you can't defend this with technology, and
25 I don't think any of the technologists looking at this For The Record, Inc. Waldorf, Maryland (301) 870-8025 206
1 believe that technology is the answer to all of this, 2 but right now, it's part of an answer, given a clear 3 policy on appropriate use. 4 MR. LIVINGSTON: Okay, here's one for Sandy and 5 Mallory. 6 Have P&G and/or retailers uncovered implications 7 of RFID for consumers that it did not expect or predict 8 during its pilots? If so, what were they, and were they 9 beneficial or detrimental? 10 MS. HUGHES: Well, we haven't found anything 11 that we didn't know already, just confirmation of the 12 point that the more education that consumers are given 13 about the technology, then the more understanding they 14 have and more acceptable they are to it, which just 15 outlines the work ahead of us as far as the education. 16 MR. DUNCAN: And I would just mention one point 17 that was demonstrated by the Capgemini/NRF study, that 18 consumers tend in the abstract to undervalue some of the 19 potential new uses, more than a lot of people think. 20 MR. LIVINGSTON: Here's kind of a fun one that I 21 don't know much about, but it's for Beth and Deirdre. 22 Does the current Coca-Cola promotion using the 23 SIM chip locator tags through the GPS system violate 24 privacy rights? If so, how?
25 I don't know how anyone can answer that. For The Record, Inc. Waldorf, Maryland (301) 870-8025 207
1 MS. GIVENS: I think I am going to show that I 2 am not a typical consumer. I honestly haven't been 3 following that campaign, so I really don't have a very 4 good answer on that one. It would be interesting if 5 someone on the panel is following that campaign and 6 knows what in the world he just said. 7 MR. PARKINSON: Okay, so a SIM chip is a 8 subscriber identification module chip inside a cell 9 phone, which in GFN and certain other types of cell 10 phones tells you who it belongs to. It tells you who it 11 belongs to by linking it back to a telephone company 12 referential database. 13 New generation phones also contain GPS 14 technology, which allows the mobile 911 service to 15 figure out within about a hundred feet, in ideal 16 conditions, a hundred meters on average, where that 17 phone is. So, Coca-Cola thought it would be cool to 18 give you the opportunity, if you opt in, for it to tell 19 you where the nearest case of Coke is if you want to buy 20 one holding your phone. 21 MS. GIVENS: It sounds as though it has an 22 opt-in, and in order to participate, you would have to 23 be fully informed as to what you're up to. It sounds to 24 me as though it would comport with the privacy
25 guidelines that I'm comfortable with, but again, you For The Record, Inc. Waldorf, Maryland (301) 870-8025 208
1 would have to know a little bit, and like I just 2 evidenced, knowing that your phone has a SIM chip in it, 3 I certainly know about GPS, but I think a lot of things 4 go together to make up kind of informed consent in a 5 situation. 6 MS. MULLIGAN: Location information is one of 7 the areas that we have kind of more protective rules, 8 and without looking at the actual information that's 9 being given to consumers, I would hate to give you a 10 legal opinion. 11 MR. LIVINGSTON: I won't hold you to it. 12 Okay, here's one for Dan and probably others 13 would like to comment on this. 14 A number of speakers have suggested that 15 consumers should be given the ultimate choice of whether 16 they want the products they buy to have RFID tags. How 17 do we educate them so they can make an informed choice? 18 Is that a reasonable expectation? 19 MR. WHITE: I have had to do a lot of educating 20 in the last year. We have had 100-plus retailers come 21 through, and I think the concepts, if you keep them 22 simple and you just explain, you know, at a fairly low 23 level what's going on, I think they can make sense, 24 because there's enough other technology that's similar.
25 We've mentioned cell phones, for example, could be For The Record, Inc. Waldorf, Maryland (301) 870-8025 209
1 considered an RFID type of situation. 2 I do think that no matter how much you try and 3 provide information, there are some people that probably 4 won't read it, and you have to take into that account, 5 and you have to do your best to try and be up front and 6 honest about them, and I think to provide that in a way 7 that people can get access to it, I think that's about 8 all you can do, because you can't force people to do 9 something they don't want to do. 10 MS. HUGHES: Again, you know, as I mentioned 11 before, the education, you know, whatever was done to 12 really recognize symbols before and what they've come to 13 mean is something that's going to, you know, take a long 14 time to do through all different types of media and 15 different types of forum, but until then, I mean, what 16 you've seen before and what Simon told you about what 17 was in the video, is just to get in the face, for 18 example, of consumers as they are buying a product. 19 HP printers at Wal-Mart, there were these shelf 20 tear-off tags that consumers could take with them, and 21 the labels that I mentioned that were on cases, and you 22 are welcome to come by and read one of these. It's got 23 questions and answers on what is electronic product 24 code, et cetera, and on the back, and the value to them.
25 The ones that are on the cases say, for example, to For The Record, Inc. Waldorf, Maryland (301) 870-8025 210
1 improve product availability for consumers, packaging 2 contains electronic product code. Upon purchase, the 3 EPC tag can be discarded, and it gives the Web site 4 address of EPCglobal, Inc. 5 So, I think there is going to be some overt 6 things that we need to do until we get to the point 7 where it's common knowledge. 8 MR. LIVINGSTON: I have a two-part question. Is 9 point of sale the best place to do that, and the second 10 is sort of a rhetorical question, I guess, would it have 11 been better for the retailers and packaged goods 12 companies that have done the various trials over the 13 past couple years to have made more of an effort to 14 communicate in that way? 15 MR. WHITE: My understanding from the retailer 16 side and dealing with retailers, point of sale is not 17 the place to do anything. You want to get them out. 18 So -- 19 MR. LIVINGSTON: I guess I meant more the shelf 20 than the point of sale itself. 21 MR. WHITE: Okay, now the shelf, where they are 22 actually shopping, where they may be trying to make a 23 decision, that may be the place. We've also had people 24 talk about a consumer service desk to provide further
25 information, have people there to maybe answer For The Record, Inc. Waldorf, Maryland (301) 870-8025 211
1 questions, they might want to understand what's going on 2 in the store, and the Web site. So, I think all those 3 areas are applicable, and trying to do it in the store, 4 where it's at, is probably the best place. I don't 5 think you could do it any other place. 6 MS. GIVENS: If I could add something, I think 7 we can learn from the privacy notices that came out 8 starting in July of 2001 regarding the financial 9 institutions. I think something that should be avoided 10 is what I call happy face technology, with a happy face, 11 and kind of overselling, doing the marketing hype, you 12 know, RFID is a technology that's going to benefit you 13 and make life wonderful and satisfying and oh so 14 convenient. 15 I think it's better just to keep the messages 16 simple and factual, and I think that consumers -- those 17 who at least pay attention to such things -- mistrust 18 something that's got kind of an aura around it of hype 19 and an oversell. 20 MR. LIVINGSTON: Okay, we have got time for one 21 or two more. Here are two related questions. 22 The first one, and this is for John and anyone 23 else who wants to comment on it, can you clarify what 24 actual information is sent out or not sent out by EPC
25 tags and how they are read? For The Record, Inc. Waldorf, Maryland (301) 870-8025 212
1 And relatedly, it sounds like there are no more 2 privacy concerns with EPC than with bar codes. Is it 3 different? 4 MR. PARKINSON: So, there is no such thing 5 technically as an EPC code. There is a set of types of 6 tags, and the type determines what you get when you read 7 it. They range from tags that are active, so they're 8 powered, they transmit and can be picked up by receivers 9 in a very wide area, down to the kinds of tags that will 10 eventually go on consumer goods cartons, which are not 11 powered. They are a chip plus an antenna with a 96-bit 12 code in a format defined by EPC in the chip. 13 To be read, they have to be within -- their spec 14 says about 20 feet, but the practice commonly is running 15 10 to 12 feet, although a power reader broadcasts a low 16 power radio frequency field which causes the chip in the 17 tag to pick up just enough energy to send out the bit 18 stream of what it is, which the reader then picks up, 19 and what it picks up is simply the set of codes, and 20 there are fields within the code. 21 The first field says what kind of code the rest 22 of the fields are. So, you could use the tag format for 23 lots of different things, including proprietary coding 24 schemes if you choose to. So, you can make them exactly
25 identical to bar codes if you want, as the Auto-ID For The Record, Inc. Waldorf, Maryland (301) 870-8025 213
1 Center and EPCglobal have done a very good job from a 2 technical perspective in building a lot of flexibility 3 into the scheme that tags and reader combinations use to 4 work. 5 To figure out what the rest of the bits mean, 6 you have to refer to an object name server that has the 7 lookup tables that said, okay, so field one says 8 25-26-34, that's Coca-Cola. Field two tells you that 9 it's a 24-pack of 10-ounce cans of Coke. And then you 10 can put some other information in if you want to, which 11 can either be in the three fields on the tag or can 12 simply be pointed to by the object name server, which 13 could point back to the Coke bottler that would tell you 14 when those cans were filled. 15 So, you have a number of layers of information 16 management in the architecture that you could choose to 17 implement in flexible ways, and at each level, you can 18 choose to put both encryption, no random person can make 19 sense of the bit stream, and security, you have to 20 provide permission to get to the next layer of 21 information. 22 So, is it different from bar codes? There are a 23 couple of critical differences, the biggest being that 24 it doesn't have to be visible on the item. So, I can
25 put a tag inside the packaging rather than having to put For The Record, Inc. Waldorf, Maryland (301) 870-8025 214
1 it outside, because bar codes must be visible to be 2 read, but it doesn't have to have any obvious 3 orientation to the reader, as long as it's within range, 4 so that readers can be hidden. They can be made 5 nonobvious in a way that you can't with a bar code or a 6 laser scanner. 7 MS. MULLIGAN: Well, just out of -- nobody has 8 ever talked to a bar code, right? I mean, you wave it 9 over -- you read it at the point of sale, and that's it, 10 and potentially, you come out, and this thing continues 11 to talk to other readers without being in any contact 12 with them, and I think for a consumer, that's a very 13 different experience potentially. 14 MR. PARKINSON: I would argue that it's an 15 extension of an existing capability, because as long as 16 a bar code is visible, I can read it from almost a mile 17 away with a laser scanner. I just have to know where to 18 point it. So, we have changed the detailed nature of a 19 problem without changing the problem, from what's the 20 persistence of the information contained in the item and 21 how do I get to it without the consumer having to know 22 about it. 23 MS. MULLIGAN: I just learned something. I 24 didn't know you could read them from a mile away.
25 That's fascinating. For The Record, Inc. Waldorf, Maryland (301) 870-8025 215
1 MR. PARKINSON: You could read them from orbit 2 if you... 3 (Laughter.) 4 MR. LIVINGSTON: Anyone else on that topic? 5 I think we're just about out of time, so I would 6 like to thank our panelists for a very lively 7 discussion. 8 (Applause.) 9 (A brief recess was taken.) 10 PANEL 4 11 MS. BROF: Okay, we're ready to start up again. 12 I'm Julie Brof again from the FTC, and I'm happy to 13 introduce this panel, which will be maybe slightly 14 longer presentations and talking about, again, looking 15 ahead, what can we expect, and we have some pretty 16 distinct visions of the future represented by our 17 panelists. 18 Starting off this panel we'll hear from Chris 19 Boone with IDC, who will address the promises of RFID 20 versus reality, examining deployment in the supply 21 chain, item-level tagging and consequences for consumer 22 privacy. 23 As a program manager covering the retail, 24 wholesale and CPG manufacturing industries for IDC's
25 Vertical Industry Research Group, Chris is an For The Record, Inc. Waldorf, Maryland (301) 870-8025 216
1 acknowledged expert in RFID use in the supply chain. He 2 has presented on RFID in many forums, most recently 3 hosting IDC's RFID Update Conference held earlier this 4 month in Boston. 5 Next we will hear from Katherine Albrecht, the 6 Founder and Director of Consumers Against Supermarket 7 Privacy Invasion and Numbering, or otherwise known as 8 CASPIAN. CASPIAN is a national grass roots consumer 9 group dedicated to cutting supermarket loyalty or 10 frequent shopper cards; CASPIAN's efforts are directed 11 at educating consumers and condemning marketing 12 strategies that invade shoppers' privacy and encouraging 13 privacy-conscious shopping habits. 14 As many of you if not most of you are aware, 15 Katherine and CASPIAN have been extremely active in 16 raising awareness about the consequences for consumers 17 of RFID use, beyond the supply chain in particular. 18 Katherine holds an Undergraduate Degree in Marketing and 19 is currently a doctoral candidate in education at 20 Harvard University where she is writing her dissertation 21 on consumer education and privacy. 22 We will conclude this panel with Jim Waldo, who 23 I had an opportunity to see speak at an RFID conference 24 in Seattle last month. So, I can say from personal
25 experience that he is not only knowledgeable but pretty For The Record, Inc. Waldorf, Maryland (301) 870-8025 217
1 funny, too. 2 He is an engineer with Sun Microsystems 3 Laboratories where he researches large-scale 4 distributive systems. Like Katherine, he can also be 5 found on the Harvard University Campus, where he is an 6 adjunct faculty member of the computer science 7 department. 8 Jim will be discussing what the future of RFID 9 will be expected to bring as well as what it will likely 10 not bring. So, let me turn things over to Chris. 11 MR. BOONE: Thanks, Julie. 12 Again, my name is Chris Boone, and I'm a program 13 manager with IDC. For those of you unfamiliar with IDC 14 as a company, we are an IT market intelligence and 15 research firm that is actually celebrating our 40th 16 anniversary this year. Our main focus is to work with 17 IT vendors, and then secondarily, we typically work with 18 the financial community to understand market 19 opportunities around hardware, software and IT services, 20 the size of those markets and forecast their growth into 21 the future. So, it gives me great pleasure to be here 22 with you today and present our vision for RFID 23 specifically within the retail supply chain and try to 24 answer the question whether or not this really is the
25 next big thing, as it's currently being touted. For The Record, Inc. Waldorf, Maryland (301) 870-8025 218
1 So, just quickly going through the agenda, we 2 will start with a brief discussion on promise versus 3 reality. We won't spend much time about promise, 4 because that's been talked to death I think today. We 5 will spend a little more time on the reality side of 6 that slide. 7 We will then talk about the RFID ecosystem for 8 the retail supply chain as we see it, again very briefly 9 there, and that is going to build into I think the crux 10 of the presentation, which is our forecast for RFID 11 within the retail supply chain, how we think it's going 12 to be adopted over the next five years, and then a 13 long-term view as well, and then briefly touch on 14 consumer privacy, because that's also going to be the 15 main focus I think for today's panel. 16 Oh, and by the way, you won't find me on 17 Harvard's Campus, even though I live in Boston, so one 18 of these kids is doing his own thing. 19 So, the promise, as I mentioned earlier, I think 20 has been talked to death today. There is a lot of 21 promise around RFID. It is the oldest new technology 22 out there in the marketplace. I won't go through this 23 specifically. The one thing that hasn't really been 24 mentioned too much on the promise side which I think
25 should be highlighted is that with RFID, because we will For The Record, Inc. Waldorf, Maryland (301) 870-8025 219
1 eliminate the line of sight with how the technology 2 should work theoretically, we are actually going to be 3 able to speed up the velocity of goods in the supply 4 chain literally on a conveyor belt. We will be able to 5 move goods much faster than we can today with bar codes. 6 In some tests, it's on the order of ten times as fast 7 when it actually is optimized. So, that actually is 8 something we haven't talked too much about today. 9 But the reality of the technology is that it 10 still costs too much. We have been tossing around 11 prices of tags, 20 to 40 cents. We actually think on 12 average it's a little bit higher today. That 20 to 40 13 cent number is when you make orders in large volumes 14 today. So, it still costs too much to deploy this 15 technology on a broad scale. 16 Standards are still in flux. There is no one 17 global standard for tagging goods with RFID and 18 electronic product code that will work everywhere within 19 one frequency band. Hopefully by the end of this year, 20 through EPCglobal, we will see such a global standard 21 that will take into account other standards, such as 22 ISO, and work in different regions of the world, but we 23 are still waiting for governments in certain regions of 24 the world to determine what they are going to do in
25 terms of UHF, how much power can be used to read those For The Record, Inc. Waldorf, Maryland (301) 870-8025 220
1 tags. So, that's an issue for the global supply chain. 2 There still is a lack of end user knowledge. I 3 think by now the top hundred suppliers for Wal-Mart are 4 pretty well versed in how RFID works, but the remaining 5 members of their supplier community are probably not as 6 well versed. The 34,000 suppliers of the Department of 7 Defense also, who will be coming on board slightly 8 outside of this realm, are still just learning about 9 this technology, and they are all struggling to build a 10 business case around it. 11 From a technical aspect, there are issues of 12 interference. We have talked about this today. UHF 13 tags don't like metal. Is there metal in a warehouse? 14 Yes. UHF tags don't like water. Is there water in 15 certain consumer products? Well, yeah, Coke -- oh, 16 wait, Coke has also got metal, crap. So, we have issues 17 with interference, from the products and also where the 18 technology is being deployed. 19 There is an inability to read 100 percent of 20 tagged cases once they're put on a pallet. I think it 21 was mentioned in one of the earlier presentations that 22 we could do this. It's still more theoretical. When 23 you actually put the cases on the pallet, you typically 24 can't read the products on the inside because the
25 products are causing interference. Remember what we For The Record, Inc. Waldorf, Maryland (301) 870-8025 221
1 just said about Coke? So, the true visibility is not 2 necessarily a reality. 3 The work-around that's been going around right 4 now is that you take all the electronic product codes 5 from all the cases and you assign them to the electronic 6 product code on the pallet, so when the pallet runs 7 through, in theory, all those cases just ran through the 8 portal as well. 9 Pilots are going on to see how we can figure out 10 how to make that technology work better, place the tags 11 better within certain products, use different tag 12 designs to get around that. One frequency in tag design 13 does not fit all. Today we've been talking a lot about 14 UHF, but we have also mentioned high frequency or 13.56. 15 We are going to see that probably at item-level tagging 16 in the future. 17 And there are a number of Wal-Mart suppliers who 18 want to be good Wal-Mart suppliers, so they want to 19 comply with Wal-Mart's mandates, but they can't figure 20 out how to make a positive business case beyond 21 compliance yet, even at that pallet and case level. 22 They know that's the first step, but they don't know how 23 to move much further beyond that. So, building 24 long-term business cases is still the challenge.
25 If we take a look at the ecosystem today, just For The Record, Inc. Waldorf, Maryland (301) 870-8025 222
1 quickly on this slide, most of what we have been talking 2 about today is the bottom part of this slide, it's the 3 tags and readers and technology, and every company that 4 is going to deploy this within their architecture is 5 going to have that layer, but that layer then is 6 basically an enabling technology as we've talked about. 7 It supplies data up to the enterprise, application and 8 system infrastructure layer of each company, and then 9 each company has got their own business processes, and 10 these are specific to an industry as well as to an 11 individual company. 12 So, what's important for these companies to ask 13 is, not necessarily how am I going to comply with the 14 Wal-Mart mandate, but what am I going to do if I have 15 access to realtime supply chain data at a more granular 16 level than I do today, and how is that going to make me 17 a better business? So, instead of compliance, we have 18 got to start building business cases at the top level. 19 We also need to be able to share this data 20 somehow. We think it is going to be through some sort 21 of partner exchange or portal. I don't believe there 22 will be this ubiquitous network that's talked about 23 because I don't think there's a business case for it 24 today. Wal-Mart doesn't want its competitors to read
25 tags that are from Wal-Mart stores. Wal-Mart probably For The Record, Inc. Waldorf, Maryland (301) 870-8025 223
1 also doesn't want its suppliers to read information 2 about other suppliers. They want to control that 3 information for competitive reasons. So, we think these 4 are going to be somewhat private exchanges. Wal-Mart 5 will probably leverage retail links to do this and other 6 retailers will do something similar as well. 7 Okay, let's move into the adoption. This slide 8 has a lot of data points. I put them up there because I 9 know it will be available on the Web site, so I am not 10 going to go through all of them here, just touch on some 11 of the key points for our forecast, which is on the next 12 slide. 13 We talked a lot about the mandates that came out 14 last year that are driving this marketplace forward. We 15 think that the new global standard from EPC will become 16 finalized probably in the fall, but we won't see tags 17 for that available until the end of 2004, and that means 18 there will be a lot of testing that still has to go on 19 around those tags. We think the tag's average cost is 20 about 50 cents, because not everyone is buying tags in 21 high volumes. 22 By January 2005, we think there will be partial 23 compliance with the Wal-Mart mandate. What does that 24 mean? We think probably all top hundred suppliers, give
25 or take a few depending on what product lines they sell, For The Record, Inc. Waldorf, Maryland (301) 870-8025 224
1 will be tagging pallets and cases that go to Wal-Mart. 2 Where are they going? They're going to three 3 distribution centers out of a total of 108 distribution 4 centers Wal-Mart has in the U.S., and they probably 5 won't be tagging all cases and pallets that go to those 6 distribution centers. They're only going to be tagging 7 those that make the most sense from a business case 8 perspective: fast-moving goods, high-margin goods. 9 Procter & Gamble, I don't know, we could ask, is 10 probably not going to tag every single product that goes 11 to its distribution centers. They probably can't afford 12 to do it yet today. They want to make sure the 13 technology works first. So, that's what I mean by 14 partial compliance by January 2005. 15 By 2006, we think we are going to see more 16 retailers deploying RFID -- Target, Albertson's made 17 announcements, we haven't heard from them since. We 18 think there will be other retailers that will be doing 19 similar work. We may not hear official announcements, 20 but we think that's going to happen, and these 21 deployments are going to start to pick up next year and 22 continue to broaden in 2006. 23 Wal-Mart has already said actually they are 24 going to go from three distribution centers to six
25 distribution centers by June of next year, and then to For The Record, Inc. Waldorf, Maryland (301) 870-8025 225
1 13 distribution centers total by October of next year, 2 and ramp up from 150 store back rooms to 600 store back 3 rooms by the end of 2005. So, we're still only going to 4 be at 20 percent of all Wal-Mart's retail stores and 5 about 13 percent of their distribution centers at the 6 end of 2005. 7 Moving into 2007, we think we're going to be at 8 close to 100 percent compliance for Wal-Mart's mandate 9 amongst all suppliers. Again, we don't know exactly how 10 far Wal-Mart will be expanded at that point in time, but 11 we think suppliers will have gotten to a point where 12 they are moving in lockstep with Wal-Mart, and actually 13 by 2008, here in the U.S., we think that these pallet 14 and case-level deployments are actually going to be 15 expanded to the point where we won't be deploying more 16 readers necessarily, but what we will continue to do 17 beyond that is spend on tags and maintenance. 18 So, actually, we think the market is already 19 going to start to flatten at that point in time. We 20 will reach we think that elusive 5 cent number. That's 21 actually just a factor of our model. We weren't trying 22 to get to it, but when we saw how many tags we thought 23 would probably be purchased, that was the number we 24 actually arrived at.
25 So, what does it look like in terms of spending For The Record, Inc. Waldorf, Maryland (301) 870-8025 226
1 over the next five years? We thought the market was 2 approximately $91 and a half million at the end of last 3 year, going to about $1.3 billion in by 2008. You will 4 notice how it's very close to 2007, that leveling off 5 trend happening there. You will also see that we have 6 some fits and bursts in 2005 and 2007, and this forecast 7 says that hardware is making up the largest portion of 8 the number. This is different from what some of the 9 other speakers have talked about today. 10 The reason why we think hardware is going to be 11 so high is that even though tags are going to be cheap, 12 5 cents at the end, we are going to be buying a lot of 13 tags by 2008. Software and services are a bit small in 14 this forecast, because we've limited our definition very 15 specifically. So, we just kept it to RFID middleware 16 and just services to deploy the technology, nothing 17 more. 18 And very quickly, because my time is up, we want 19 to show you a long view here. We think that we're going 20 to have a peak around 2008. We think it's going to 21 decline beyond that, as we're trying to figure out how 22 to do item-level tagging in the future, and that won't 23 pick up for quite a number of years off. There are 24 going to be a number of technical and cost challenges
25 that we still won't be able to overcome until well For The Record, Inc. Waldorf, Maryland (301) 870-8025 227
1 beyond 2008. 2 This follows a similar pattern to other "next 3 big thing" technologies. Those of you who followed the 4 PC market in the early eighties may recognize a similar 5 growth pattern, big boon, bust, then a real wave of 6 growth happening well beyond that. We think that's 7 going to be the case here as well. 8 Then consumer privacy, I am going to leave most 9 of this to I think Katherine's talk here. It is a top 10 concern. State legislation has been introduced, we have 11 already heard in a number of states about a consumer's 12 right to know if the technology has been deployed, and I 13 think the take-away message from this is regardless of 14 legislation, what retailers and suppliers should not do 15 with the technology is just as important as what they 16 can and should do with the technology. 17 And here's my email address if you need to 18 follow up with me afterwards. Thanks. 19 MS. ALBRECHT: Thank you, Chris, for that 20 overview of how RFID is coming. 21 I'm Katherine Albrecht. I'm the Director of 22 CASPIAN. Many of you in this group I'm sure know me as 23 a consumer privacy ally, and others of you perhaps know 24 me as the person who shot down the Benetton trials and
25 gave them some headaches last year, that they engaged in For The Record, Inc. Waldorf, Maryland (301) 870-8025 228
1 some unannounced and secret trials involving consumers 2 and RFID. 3 I am going to fit about a half an hour worth of 4 slides into about 15 minutes, so I am going to advise 5 anybody sitting in the middle, if you would kind of like 6 to position yourselves so you can see the slides, this 7 is a very slide-centric and image-heavy presentation I 8 am going to be delivering. 9 For those of you who are not familiar with our 10 work, you can find it -- our primary RFID work is on 11 spychips.com. My background, as Julie mentioned in the 12 introduction, is fighting supermarket loyalty cards and 13 other forms of data collection. You can find that 14 information at nocards.org, and there, of course, is 15 information on our two boycotts, which were Benneton and 16 also Gillette. 17 I think one of the key things to keep in mind 18 here in understanding and separating out what the 19 privacy issues are revolving around RFID is the 20 difference between essentially three databases, and I've 21 developed this myself as kind of a way to help to 22 untangle some of the privacy concerns versus just 23 looking at supply chain issue-types of questions that 24 have been raised.
25 The first database is the one that any company For The Record, Inc. Waldorf, Maryland (301) 870-8025 229
1 manufacturing something would be looking at on the 2 factory side. When something rolls off an assembly 3 line, as it moves from the assembly line onto a truck, 4 into a warehouse, into a distribution center, that would 5 be the first database. That database really doesn't 6 pose any issues for consumer privacy. 7 When I say "database," what I mean is that when 8 you put an EPC or an RFID tag into an item when it's 9 manufactured, the only information contained on the 10 cheapest versions of those tags would be the actual EPC 11 number or the unique ID number. That unique ID number 12 in and of itself doesn't really communicate anything in 13 the same way that your social security number doesn't 14 really communicate anything, but when you link it up 15 with databases, that's when you can find out information 16 about where you've been, where you've worked, what 17 credit you've applied for and other information about 18 you. It's similar here. So, the first database we've 19 identified is not really involving any privacy concerns 20 for consumers. 21 The second one is the database that enables you 22 to know, if I scan an item and I see what the item is, I 23 can look that number up in the ONS system or in whatever 24 EPCglobal makes available to Wal-Mart, for example, to
25 know that what it just ran over its scanner is a bottle For The Record, Inc. Waldorf, Maryland (301) 870-8025 230
1 of Pantene shampoo, for example. If I can scan your 2 briefcase or your wallet or your purse or your pocket 3 and I can get that number back, I can look it up and 4 essentially know what's in your briefcase, your pocket 5 or your purse. There, I think the implications for 6 privacy are quite obvious to consumers. 7 Let me jump ahead to these slides. This is the 8 first one, database number one, Cherry Chapstik produced 9 on assembly line 12 at 3:15. No one is particularly 10 worried about that from a privacy perspective. 11 Database number two, I scan your pocket and I 12 discover item blah-blah-blah, 308247, I'm shortening 13 that down to the end. If I look that up in what will be 14 the widely available EPCglobal database, I will be able 15 to determine that that is a Cherry Chapstik, and I would 16 know what's in your pocket. This poses the most obvious 17 privacy concerns for consumers, but to be perfectly 18 honest with you, this is the one I'm least worried 19 about. 20 The reason I'm least worried about it is because 21 I think it is so incredibly apparent to people that it 22 is problematic to have the person sitting next to you on 23 the bus know what's in your backpack or know what's in 24 your suitcase. So, I think consumers in their own and
25 on their own will object to this, to the creation and For The Record, Inc. Waldorf, Maryland (301) 870-8025 231
1 the use of this type of database with these tags or 2 having the tags live, because I don't think there's any 3 way we can control the use of this database. 4 The third one is the one that I'm concerned 5 about, because it's invisible, and it's far less 6 obvious. This is the database that gets created at the 7 point of sale. So, now when I go into a Wal-Mart and I 8 buy that Cherry Chapstik number 308247 and I pay for it 9 with a credit card, or let's say I walk into an 10 Albertson's or a Safeway and I pay for it with my 11 loyalty card, even if I pay cash, I've identified 12 myself, and that information. Currently, what few 13 people realize, although perhaps in this room many 14 people realize it, is that currently when you pass 15 through a checkout line and you go to the point of sale 16 and you present anything at all that identifies you, the 17 information of your identity is linked in that store's 18 database along with the SKU numbers or the bar code 19 numbers of the items you bought. 20 So, in other words, most retailers, most major 21 national and international retailers, are maintaining 22 databases right now on consumer purchases linked up with 23 the bar code numbers of what they buy. That in and of 24 itself is quite problematic.
25 It becomes more problematic when it doesn't For The Record, Inc. Waldorf, Maryland (301) 870-8025 232
1 just -- and I think the comment was made right before 2 the break, was that these don't pose any more of a 3 threat to privacy than bar codes, and in reality, they 4 pose considerably more threat than a bar code, 5 because -- well, there's two reasons. 6 One is I can't read what's in your pocket right 7 now if it has a bar code on it. You would have to 8 actually show it to me and hold the bar code up to a 9 reader within the line of sight. That's simultaneously 10 one of the downsides and one of the tremendous benefits 11 of this technology. 12 The other reason that it's very different from a 13 bar code is that it's difficult -- I can link a bar code 14 up with your identity, and in fact, retailers do that, 15 but essentially, if I have access to that record, all I 16 would know would be that you bought Cherry Chapstik. I 17 wouldn't know which one, and the which one becomes quite 18 important in a way that we will look at here. 19 This database three that links up the EPC 20 numbers or the unique ID numbers with consumers is, I 21 believe, quite likely given the current what we call 22 retail surveillance environment in place in retail 23 stores today. The concern here ties in when you have 24 item-level tagging. I believe this image is from
25 CheckPoint. It is working on integrating their For The Record, Inc. Waldorf, Maryland (301) 870-8025 233
1 anti-theft devices with RFID tags with unique numbers 2 that would beam over a distance, and of course, as you 3 can see on this image, it would be virtually impossible 4 for the consumer to know about them. 5 Combined with ubiquitous readers, which I'm sure 6 if you read the literature of people selling this 7 technology, these readers can be embedded virtually 8 anywhere in the environment, in walls, doorways, floor 9 tiles and carpeting. Combined with current levels of 10 retail data capture and abuse, and I'm going to talk 11 about that more in a moment. 12 I believe that all of this combined will lead to 13 widespread surreptitious consumer surveillance. For 14 those of you who have been following the RFID issue 15 through 2003, you might recognize this. This is a 16 picture of the smart shelf from Gillette, which was 17 tested at Tesco stores in Great Britain and at Wal-Mart 18 stores here in the United States. We call it the spy 19 shelf. 20 Essentially that little device under there was 21 detecting the presence of the Mach3 razor products, and 22 when one was picked up, the camera took a close-up 23 photograph of the shopper's face for anti-shoplifting 24 purposes.
25 So, the other thing we're concerned about is the For The Record, Inc. Waldorf, Maryland (301) 870-8025 234
1 use of hidden tags. These images actually came from the 2 Auto-ID Center, and again, anyone who's been following 3 this issue will know that last summer we uncovered some 4 unprotected confidential documents on the Auto-ID 5 Center's Web site. Among those documents were slides 6 showing hidden tags. If you see a six-inch tag, it 7 looks like it would be difficult to hide in a product, 8 but the following slide in their presentation shows it 9 sandwiched in cardboard, literally hidden between the 10 layers of paper in the cardboard. 11 Here's a six-inch tag, this is actually made by 12 Alien, and this has a 17-foot read range according to my 13 own experiments with it, and these were hidden in the 14 tops of Pantene shampoo bottles. For anyone who buys 15 Pantene, which was my brand before I began boycotting 16 Procter & Gamble products, this is the type of lid that 17 flips up, so the consumer would never actually realize 18 that there was a tag inside of there. Again, we don't 19 know where these were sold. We don't know who they were 20 sold to. We have repeatedly asked them for a 21 clarification, and we have not received any. 22 Another big tag, four and a half inches, and 23 this one was placed between the layers of paper on 24 Purina dog food, again, according to Auto-ID Center
25 slides, and that would go between that greasy inner For The Record, Inc. Waldorf, Maryland (301) 870-8025 235
1 layer and that inner paper layer, where you wouldn't 2 normally be pulling that apart. So, I gather if you 3 bought that brand of dog food, you wouldn't be looking 4 there for it. 5 Getting even worse, these RFID chips are getting 6 quite small. This is the Hitachi MU chip, which is 7 unbelievably tiny there. It would be easy to hide this 8 RFID chip, particularly if the antenna were made of 9 conductive ink, and that's one of the directions that 10 the industry is going to, because they're cheaper, to 11 print the antennas on using conductive ink and simply 12 stick the little guy onto the conductive ink, which 13 could actually form part of the package, and the quote 14 here, with these things, you can literally tag a pack of 15 chewing gum. They have mixed the conductive ink with 16 regular packaging ink to create antennas on boxes of 17 cereal and other disposable packaging. So, literally 18 your box of Kellogg's Corn Flakes could contain an RFID 19 tag and be remotely read without your knowledge. 20 The other thing, tags being left active. This 21 is a quote from Wired Magazine. Sandy, you -- I believe 22 it was from the RFID Journal, when Sandy Hughes spoke, 23 it was reported she said that P&G and other companies 24 suggested they want to keep RFID tags active after
25 checkout rather than disabling them with so-called kill For The Record, Inc. Waldorf, Maryland (301) 870-8025 236
1 machines. The companies also want to match the unique 2 codes emitted by RFID tags to shoppers' personal 3 information. 4 If you combine all of that with individual 5 tracking and profiling, what you see up there on the 6 screen is a blank for a Matrix RFID enabled loyalty 7 card. I actually encountered one of these cards when I 8 went in January to tour the Future Store, the Metro 9 future store in Rheinberg, Germany. That is the store 10 that the retail industry is touting as the future of 11 retailing, and if it is, then we are all in deep 12 trouble, because what I discovered at that store was 13 that unbeknownst to any of the shoppers -- and by the 14 way, 22 million Germans carry this pay-back loyalty 15 card -- unbeknownst to any of those shoppers, they had 16 hidden an RFID tag in the loyalty cards and distributed 17 these to customers. 18 I discovered that in the presence of television 19 cameras, and it was a huge scandal across Germany. It 20 was front page news in a number of their newspapers and 21 was top of the evening news, and they finally were 22 forced to recall those cards, but that's a great example 23 of what happens when you have a desire to track 24 consumers and it's not tempered by the consumers'
25 ability to know about it. For The Record, Inc. Waldorf, Maryland (301) 870-8025 237
1 This slide you see here is from Texas 2 Instruments' Web site, ubiquitous readers. It actually 3 says, "Consumer loyalty mechanism with TI RFID," and it 4 shows a woman walking past an antenna, and as you'll 5 see, her loyalty card is being read right through her 6 purse, and there is really no indication that she is 7 aware of that happening. 8 This is an image that was up on Alien's Web site 9 for over a year and a half. This comes from Forbes 10 Magazine, but at the top it says, "As the shopper enters 11 the store, scanners identify her clothing by the tag 12 embedded in her pants, shirt and shoes. The store knows 13 where she bought everything she is wearing." 14 Now, the chances of that are actually unlikely 15 that the store would know where she bought what she was 16 wearing, but the chances that they would know what she 17 was wearing are actually quite likely. 18 All right, this comes from a company called Copy 19 Tag, and it shows a worker walking into a room, but what 20 you'll notice is hanging off of him are a number of 21 different tags. Now, the idea is that this doorway 22 would be reading those tags. For us as consumers, those 23 tags might be better concealed. They might be in the 24 tags of our clothing or our underwear as Benneton had
25 planned. They might be on our loyalty card in our For The Record, Inc. Waldorf, Maryland (301) 870-8025 238
1 pocket. 2 And then this final slide of ubiquitous reading 3 devices actually shows how you can rig carpeting with 4 electro or actually electrical sensors. In this case 5 these are actually little light sensors, so this is a 6 bit of a stretch, but it has been experimentally proven 7 that you can easily embed RFID reader devices into 8 carpeting, hide them under floor tiles and put them in 9 other places. So, the idea of walking around and 10 actually have the environment sense you and what you're 11 wearing is quite disturbing. 12 Now, NCR, who is here today, is interested in 13 associating purchase data with unique tag numbers. This 14 means actually linking up your name with the tags on 15 you, so I suppose later, when someone who has access to 16 that database reads the tag, they can determine who you 17 are. They include in their 50 ideas for revolutionizing 18 the store through RFID, including the date of purchase, 19 the name of the individuals associated with the product, 20 the date of the sale, the price of the sale and other 21 information, actually having that linked in the database 22 with those tags. 23 So, as you can imagine, if your shoe is the only 24 item on planet earth that contains unique tag number
25 308247 and someone reads tag number 308247 and looks it For The Record, Inc. Waldorf, Maryland (301) 870-8025 239
1 up in the database, they can determine who you are and 2 where you bought that item. The who you are is the 3 quite worrisome part, because it creates the potential 4 for tracking people all the time. 5 I actually put this slide up here not realizing 6 that Marty Abrams, who is the subject of the slide, 7 would be in the audience today. He actually talks about 8 CRM, customer relationship management, which is the 9 invisible layer between the retailer and consumer. It's 10 estimated to be between a $10 and $15 billion industry 11 of essentially gathering consumer data and in my opinion 12 manipulating it in order to manipulate consumers. It 13 involves an incredibly complex network of surveillance, 14 and one of the things that Marty explains as the purpose 15 for this surveillance, he says, "Maximization means 16 'marginal service and high prices designed to drive the 17 unattractive customer somewhere else.' In other words, 18 CRM facilitates customized pricing and customized 19 service based purely on what the data and models tell 20 you about the potential profitability of the customer." 21 So, the reason they want all of this 22 infrastructure to determine who you are is so they can 23 either -- I believe Marty, as you put it -- treat you 24 with kid gloves or the white glove treatment. I think
25 if you're a shopper they want to cater to you, and to For The Record, Inc. Waldorf, Maryland (301) 870-8025 240
1 discourage you from shopping at the store with higher 2 prices and poor service. So, what this might lead to is 3 as I walk into the store now with my pay-back loyalty 4 card in my purse and you see the tag on there and you 5 say, ah, this isn't just a shopper we should welcome as 6 any other shopper, this is Katherine Albrecht, and we 7 don't like Katherine Albrecht, so we are going to offer 8 her higher prices and poor service. 9 You can also do the same thing not only with a 10 customer loyalty card, disturbingly enough, but you can 11 do the same thing with any product I bought in your 12 store. So, if I bought a Cherry Chapstik in your store, 13 you can use that to look up information about me. You 14 could sell that information to other people so they 15 could determine what kind of person you think I am, and 16 anywhere I go where you can read my Cherry Chapstik, by 17 linking it up with a database, you would know who I am 18 as soon as I walk in through the doorway. 19 Procter & Gamble says we can trust retailers 20 with this information. Procter & Gamble says, 21 "Retailers selling its goods can be trusted to guard 22 consumers' privacy even if they decide to match their 23 personal information with the serial numbers from the 24 RFID tags." I say the retailers can't be trusted.
25 This image is an actual promotional image, if For The Record, Inc. Waldorf, Maryland (301) 870-8025 241
1 you can believe it or not, this guy with the magnifying 2 glass standing in a grocery cart is from a company 3 called PathTracker. They actually -- let's see, 4 "Records the coordinates of a shopper from the time they 5 enter the store and select their shopping cart until 6 checkout, becomes a database for each shopper tracked." 7 In addition, the path data can be tied to the 8 shopper's actual purchases. They are using a 9 combination of RFID and GPS technologies in grocery 10 carts to literally follow people around the store, 11 identify them at the point of checkout and link all of 12 this information together, and at this particular image, 13 it is an image of the exact track that a shopper took 14 inside of a store. 15 Now, imagine how much easier this would be if 16 you had an RFID instead of all this expensive 17 PathTracker technology, because the RFID will already be 18 in place on the shelf, so you can simply determine who's 19 walking past in addition to reading the products on the 20 shelf. Who's doing this? These are PathTracker's 21 clients, and as you can see, they are some of the 22 biggest retailers in the country. This is just a 23 partial list. 24 And this slide, I'm almost to the end here, this
25 would have been an IBM image of a very sophisticated For The Record, Inc. Waldorf, Maryland (301) 870-8025 242
1 technology that actually showed people walking around, 2 and it put boxes around them and identified them as 3 person one, two, three and four, and tracked their 4 actual movement around the store in real time on a real 5 video, and they're using the surveillance cameras you 6 think are there to stop shoplifting for that purpose. 7 This video does the same thing, but it does it 8 to cars and people. Once again, RFID is much more 9 cost-efficient for doing this, especially if it becomes 10 ubiquitous. 11 Of course, Michelin is looking at putting it on 12 tires, meaning that all you have to do is put reader 13 devices on roads, and then you would know every single 14 person who drove on that road. There is even a company, 15 Applied Digital Solutions, that wants to embed these in 16 people. Already they've began trials to do just that. 17 Our concern is that ultimately, if you put this 18 technology into this current environment, which is 19 already so surveillance-happy when it comes to consumers 20 and so intent and willing to violate consumer privacy, 21 that we believe the abuse is inevitable. 22 These are just a couple of protest images. I 23 take great exception to the referenced consumer study 24 that shows that consumers accept this technology.
25 Hundreds and hundreds of thousands of emails later, I For The Record, Inc. Waldorf, Maryland (301) 870-8025 243
1 can tell you consumers really don't like this 2 technology, and they will do everything in their power 3 to fight against it. So, I'll just leave you that as a 4 warning. 5 Real quick, Proctor & Gamble, Wal-Mart, have not 6 exactly been aboveboard with their trials. We have had 7 some problems with Gillette as well, which you can learn 8 about on our Web site. You can see images of the 9 tracking devices. This will all be available in the 10 slide presentation on the FTC's Web site, and we will 11 put it on our spychips Web site as well. 12 I will leave you with that image. This was the 13 protest in Rheinberg, Germany after consumers discovered 14 that they had had loyalty tags -- RFID tags hidden in 15 their loyalty cards. They actually turned out in quite 16 a bit of snow when the roads were shut down to turn out 17 to the store and protest. 18 On that note, I'll leave it as a note of 19 caution. I'll also say that we have worked successfully 20 with several retailers and consumer product companies in 21 discussing ways that they can mitigate some of the 22 privacy concerns. 23 Thank you very much. 24 MR. WALDO: So, making the standard disclaimers,
25 I am not speaking as a representative of Sun For The Record, Inc. Waldorf, Maryland (301) 870-8025 244
1 Microsystems or much of anybody else. I, in fact, bring 2 you greetings from Planet Geek and will talk on it that 3 way. So, first of all, I -- also, as part of this, by 4 the way, I am one of those guys who will receive the 5 70-some odd percent of the money going into RFID. I do 6 software for distributed systems, and we can talk about 7 what you do with all of that data. It turns out 8 actually RFID tags generate a lot of data, almost all of 9 which is uninteresting, and I'll tell you why later. 10 But let's start off by being precise, because 11 this is something that almost never happens in 12 discussions of RFID. Lots and lots of things are called 13 RFID, and they have lots of different characteristics, 14 and it's important to understand the distinctions. 15 RFID tags are, at least in my lexicon, defined 16 as using RF wireless technology, transmitting only a 17 unique identifier, and either using passive or battery 18 power. Now, there are lots of things that do that and a 19 bunch more, so earlier today, we heard somebody say, 20 well, you know, your cell phone uses RF, and it does 21 have a unique ID, so it's an RFID device. No, it's not. 22 If it were just an RFID device, you wouldn't use it. 23 It's a cell phone, right? It does a lot more than just 24 transmitting an unique ID.
25 RFID tags are not sensors, they are not For The Record, Inc. Waldorf, Maryland (301) 870-8025 245
1 actuators, they are not dumb computers. If they were 2 dumb computers, they would be really dumb. What they 3 are is identification tags, that's it, and that's what 4 I'm going to talk about. 5 Now, even inside of that, there are interesting 6 distinctions between things like active RFID that you 7 use for automatic payment of tolls, physical access 8 control, some of them are being used to slap inventory 9 indicators on containers on container ships, things like 10 that. These things tend to have batteries. That's why 11 they're active. They can actually generate RF 12 themselves. They don't have to be yelled at before they 13 respond. 14 But they also have some other properties. They 15 are large, they have big antennas, and they are 16 expensive, and that expense is not going to go down a 17 whole lot, because the expense is not in the chips. The 18 chips are cheap, right? Getting something that 19 generates a 96-bit ID is not hard. The hard part is the 20 antenna and the battery. And while chips, thank God, 21 are still operating under Moore's Law, antennas and 22 batteries are not. 23 Right now your battery on your laptop has about 24 the same data density as a stick of dynamite that size
25 or about same energy density. You don't want it to have For The Record, Inc. Waldorf, Maryland (301) 870-8025 246
1 any more energy density than that. This is why you 2 shouldn't burn those things, because they act even more 3 like dynamite then. So, those are the active ones, but 4 they're expensive. They are like, you know, 40 or 100 5 bucks a pop. You put them on expensive things like 6 containers, right, or to make sure that, you know, you 7 can put them in things where people do weird stuff like 8 pay money by them, right, then people are willing to 9 spend the money. 10 Then there are the passive RFID chips, right, 11 the ones we've mostly been talking about today, which 12 can be little, bitty tiny things; however, the antennas 13 have to be fairly large, because they not only have to 14 generate out this stuff, but they have to get all of 15 their energy by shooting radio frequency at them, and 16 the wonderful thing for us who are worried about 17 privacy -- and I am, although I am one of the bad 18 guys -- is that radio frequency stuff obeys an inverse 19 square law, right? 20 Some of you took physics, I know you did, even 21 though this is the highest tie to T-shirt ratio audience 22 I have spoken to in years, but some of you took physics, 23 so you know what inverse square laws are. That means 24 that if you want to read something at 20 feet that you
25 have been able to read at 10 feet, you need not twice as For The Record, Inc. Waldorf, Maryland (301) 870-8025 247
1 much energy, but the square of the energy, and squares 2 go up really fast for those of you who didn't take 3 physics, right? For those of you who are the lawyers, 4 that's really big, okay? So, those are the passive 5 ones, and that means that you can't read them from very 6 far away. 7 Now, everybody's talking about these passive 8 things can be read at ten meters. Well, they can be 9 read at ten meters in Texas Instruments' labs under the 10 best of conditions, but not in the factory and certainly 11 not on the street. On the street, you're lucky if 12 you're going to get a meter or two out of them. 13 I was talking to the guy that you are going to 14 be hearing from Marks & Spencer, he is saying, no, no, 15 you know, you have got to get up real close, because it 16 all depends on how many of the tags you're reading, 17 because you're basically shouting at them and they're 18 shouting back, right? One of the things about RFID is 19 that they are the computing equivalent of 20 three-year-olds. 21 All they do is tell you, "I'm here, I'm here, 22 I'm here, I'm here, I'm here." They don't tell you much 23 else, and in fact, it's even worse than that. It's not 24 "I'm." It's, "A long number is here." So, they are
25 like three-year-old computers, and that's not very For The Record, Inc. Waldorf, Maryland (301) 870-8025 248
1 helpful if you are getting all bunches of them, because 2 then they have things that have differential backoffs. 3 So, if you want to get 100 percent read, you 4 have got to be pretty close with fairly sophisticated 5 equipment, and you have to make sure inconvenient things 6 like metal and water and other stuff that gets in the 7 way isn't there. So, those are -- now, you have all 8 heard about that. 9 What I am going to urge you today is don't 10 confuse the categories. Don't cross the beams, all 11 right? There are RFID tags that can be read from a long 12 way away, but when you think of that, think really 13 expensive, not going to be useful very much. There are 14 the ones that can be really cheap. They get read really 15 close by. Don't fall into the trap of saying, oh, it's 16 RFID, they can be really cheap and read from a long way 17 away, which is what a lot of people are worried about. 18 They can't. 19 Now, even the passive ones can be read in some 20 sense without you knowing about it, but remember, you 21 need an antenna about the size of a plate, you need to 22 be within about three feet, and to get any further back, 23 you have to start generating the square of the energy so 24 that if they're reading from very far away, you're not
25 only going to get your stuff read, you're going to get a For The Record, Inc. Waldorf, Maryland (301) 870-8025 249
1 tan, and so you'll notice these things, okay? 2 Now, what's it going to be like tomorrow? Oh, 3 man, I have got to go really fast. What's it going to 4 be like tomorrow? Passive tags will expand to 5 pharmaceutical tracking, government supply chain, 6 military inventory, all that stuff we have been talking 7 about, and that's about it. Active tags, military 8 identification, right, those guys are willing to pay 9 extra money, right -- it's all ours, but they'll pay it 10 -- and more pay as you go. 11 The technology challenges for the foreseeable 12 future are not putting more information in these things. 13 The first challenge is cost reduction, the damned things 14 cost too much. And the next three or four iterations of 15 Moore's Law on this is going to be cost reduction. And 16 then the next problem is they still cost too much, 17 because the antennas cost too much. And beyond that, 18 there's a real problem in getting the chip-antenna 19 bonding to work right, because as you make these chips 20 smaller and smaller and you try to attach them to the 21 antenna, it gets harder and harder. So, you know what 22 happens when it's hard to attach these things? They 23 cost too much. So, those are going to be the first 24 three things.
25 Beyond the foreseeable future, what they're For The Record, Inc. Waldorf, Maryland (301) 870-8025 250
1 going to be working on are things like transmission 2 reliability, reader reliability and the administration 3 of readers. I don't know how many of you have ever 4 administered a network of computers, but every time you 5 add four or five computers in, and each one of these 6 readers is a computer, every time you add three or four, 7 the cost of administration goes up by a lot more than 8 three or four, right? It gets a lot more. 9 So, this vision of ubiquitous interconnected 10 readers, while it's a nice vision, will cost more than 11 anybody can afford to do it. None of these companies 12 that are doing RFID want ubiquitous readers. They want 13 them in a couple of places. In fact, most of the ones 14 I've talked to don't even want them out on the shelves, 15 because out on the shelves -- which by the way is where 16 they get their 50 terabytes of data a day -- it's too 17 expensive. It's 500 bucks a shelf, and in Wal-Mart, 18 there's a lot of shelves. They don't want to do that. 19 RFID tags, remember, are really bad sensors. 20 Now, there are people doing interesting work in trying 21 to use them as sensors and inferring all sorts of stuff 22 from them, kind of invisible man things that are going 23 on, and those are interesting, but they are only good at 24 one thing, which is they can tell you that they are
25 there. They can tell you the number that's there, and For The Record, Inc. Waldorf, Maryland (301) 870-8025 251
1 they're good at being cheap, although they are not as 2 good as being cheap as they should be. 3 Using them as sensors requires that you be 4 really clever and come up with all these inferences, and 5 by the way, whenever we're clever and we're coming up 6 with inferences, we're generally wrong, and if by 7 noticing second or third order effects, and you end up 8 being wrong a lot with second order effects and being 9 wrong even more with third order effects, and the thing 10 is, we know other ways of building sensor networks. 11 They're called sensors, right? 12 You want to find out if Grandma turned on the 13 faucet? Well, put a sensor in the faucet. Don't put it 14 an RFID tag to find out if she came close. Put a sensor 15 in the faucet to find out what the water flow was. 16 Hello? Is this that hard? You know, I mean, we're 17 geeks, and so we like to do that kind of thing, but 18 let's get real here. 19 So, most people, I will claim, are not going to 20 notice RFID tags, because there's not going to be much 21 of anything to notice. There may be attempts at 22 automated checkouts where the RFID tag is going to have 23 a reader in the shopping cart. By the way, you are 24 going to be damned sure that you are going to know about
25 that, because it's going to be large. There may be For The Record, Inc. Waldorf, Maryland (301) 870-8025 252
1 product information kiosks or shoplifting protection 2 systems. 3 By the way, when I tried the shoplifting 4 protection systems, they don't work very well, because 5 it's so easy to block these things. There are not going 6 to be many of those, because the cost is too high, the 7 benefit is minimal, and as we are seeing today, the 8 politics is ugly. Not you, the politics. 9 Now, here is my favorite RFID paranoia. This 10 was an ad on the internet for an RFID sniper rifle. It 11 supposedly has a range of a thousand meters, can insert 12 an RFID tag into somebody, they won't feel anything more 13 than a mosquito bite, and you will be able to track them 14 by satellite. 15 Now, this appeared on the internet, and they got 16 orders for it. Get a grip, folks, all right? They not 17 only don't understand the RFID technology, they don't 18 understand the physics of shooting things a long way, 19 right? If you can shoot something a thousand meters, 20 then if it hits you at ten meters, it's going to blow a 21 hole in you that you don't want to think about, but this 22 is an example of where people are in their thinking. 23 Now, in some sense, I find this very 24 complimentary. They think that technologists like me,
25 we can do anything. Ooh-ha-ha-ha-ha. We can't. Get For The Record, Inc. Waldorf, Maryland (301) 870-8025 253
1 over it. We can't. And even if we could, it doesn't 2 mean that we would. 3 So, RFID is important. The technology has lots 4 of promise for things like greater economic 5 efficiencies, superior control over goods, convenience 6 in certain applications, mostly in the supply chain, but 7 it's not going to change our world, be noticeable by 8 everyone or change the way we compute. 9 Now, this doesn't mean, by the way -- and this 10 is for my friends that are privacy advocates, and I do 11 have some -- this doesn't mean that there aren't real 12 privacy concerns going on, but the privacy concerns 13 shouldn't be around RFID, because every time you hear 14 privacy concerns about RFID, it's RFID tags allow you to 15 access the database, right? That's what the phrase is 16 always. The problem is accessing the database. 17 Now, we know how to secure databases. We have 18 been doing that for a long time, and the question is, 19 what should our policy be on databases, not what should 20 our policy be on RFID tags. It's the information that 21 gets gathered. 22 And in fact, I was pointing out at the break 23 that were I, in fact, a mad scientist instead of a 24 merely pissed off one, that I would think it would be a
25 great thing to get people all stirred up about RFID For The Record, Inc. Waldorf, Maryland (301) 870-8025 254
1 privacy so that they would be worried about that, and I 2 could go off and invade the real privacy on the 3 databases myself. Ooh-ha-ha-ha-ha. That's what we 4 should worry about, not the RFID stuff. 5 With that, I thank you. 6 MS. BROF: And thank you, too, and I think we're 7 really out of time, but I think we got a pretty complete 8 picture of some of the concerns, what we shouldn't be 9 concerned about, and maybe a challenge to the next panel 10 when we're talking about some of the technological fixes 11 that are proposed that -- I mean, one observation is 12 that the full title of this workshop should not be 13 "Radio Frequency Identification" but "and Database 14 Access," and I think everyone sort of agrees on that as 15 being a key, core concern. 16 So, with that, I give you the next panel, and 17 they'll be available for questions afterwards, I'm sure. 18 (Applause.) 19 (Pause in the proceedings.) 20 PANEL 5 21 MS. THORLEIFSON: Good afternoon. I'm Tracy 22 Thorleifson. I work with Julie Brof in the Regional 23 Office in Seattle, and I'm glad to see most of you still 24 here. I hope this panel can follow up on some of the
25 previous panel's presentations and also in coming up For The Record, Inc. Waldorf, Maryland (301) 870-8025 255
1 with some solutions or recommended solutions. 2 With me as a co-moderator is Elliot Maxwell. 3 Mr. Maxwell is a corporate strategist and attorney who 4 consults and writes on the intersection of business 5 technology and public policy in telecommunications and 6 electronic commerce. 7 If he wants to elaborate on that more, I'll let 8 him, but he is an expert in this area, and I'm delighted 9 to be co-moderator with him, and with that, I'll turn it 10 over to you. 11 MR. MAXWELL: In the interest of full 12 disclosure, I'm also the last three years or so the 13 Chair of the International Public Policy Advisory 14 Council for MIT at the Auto-ID Center on this 15 technology, and I also do that for EPCglobal. 16 Let me just sort of make a couple of remarks 17 before we start off. This technology is really 18 interesting in lots of ways, and one of the ways that 19 it's interesting is it's a traditional infrastructure 20 technology, and what does that mean? 21 One thing it means is that anybody who says that 22 they really know how it's going to be used and all of 23 its ramifications is absolutely wrong, because what 24 we'll find is that there's lots of things that will
25 happen with this as the infrastructure develops that For The Record, Inc. Waldorf, Maryland (301) 870-8025 256
1 nobody ever expected. 2 Think about the internet and whether we could, 3 in fact, have predicted all of the things that happened 4 with that. We couldn't have. So, even on the positive 5 side or the negative side, we don't know yet, but we 6 know that it's infrastructure. 7 It also has some very interesting applications 8 in terms of the economics. Imagine building a phone 9 system, right? If you build a phone system and said 10 that the first user had to pay for the phone system, how 11 many phone systems do you think would be built? Zero, 12 because the real value comes when the phone system 13 extends to lots and lots of people, when you connect 14 lots and lots of people. That's all of what network 15 effects were about. 16 So, the economics of this means that it has to 17 sort of roll out, and yet the burden of paying for it 18 comes with the first users, and so that means it may not 19 go as fast as people have suggested. In fact, it's very 20 likely that it follows another set of rules, and that is 21 that we are constantly underestimating the difficulty of 22 implementing a technology, constantly underestimating 23 the time a technology takes to get implemented, 24 constantly overestimating how quickly these things will
25 happen, because we can describe what we think will For The Record, Inc. Waldorf, Maryland (301) 870-8025 257
1 happen, but we forget about the difficulties, and 2 constantly underestimating the long-term impact of 3 infrastructural technology. 4 So, probably when we talk about these things, we 5 say there's a Wal-Mart mandate, and the Wal-Mart mandate 6 is for all of its largest suppliers to be putting tags 7 on the materials that they ship to Wal-Mart, and yet we 8 also know that it's only going to take a very small 9 piece of the Wal-Mart chain of commerce in the first 10 several years. It's not as if like dragon's teeth this 11 stuff appears magically all over the country, all over 12 the world. 13 So, we have in some ways some time to think 14 about, as this technology plays out, what to do about 15 it, and we have some alternatives to think about how to 16 do it right, and this is one effort today, among others, 17 to think about how to do it right. 18 A second interesting thing about this technology 19 is that for one of the first times, the interests of 20 corporations in protecting their competitive information 21 is lined up with the interests of consumers in 22 protecting information about themselves. 23 Now, think about this. As people mentioned 24 before, Wal-Mart doesn't particularly want Target to
25 know what its relationship is with its suppliers, and For The Record, Inc. Waldorf, Maryland (301) 870-8025 258
1 Gillette doesn't want Target to know what its 2 relationship is with Wal-Mart, and all along this chain, 3 the companies are saying I have got incredibly valuable 4 information I want to protect. 5 Similarly, consumers are saying in many 6 instances, we want to be sure that you control the 7 information that you get, who has access to it, what 8 they do to it. So, we need to be spending a lot of time 9 thinking about this question of access to databases, but 10 we are, in fact, lucky that those two things are in 11 line, because what it will mean is that there are going 12 to be people thinking from both the corporate side and 13 the privacy side about how to deal with this question of 14 access. 15 The third thing that we should be thinking about 16 is that there are usually a number of different ways to 17 deal with public policy issues, and it's usually not 18 binary. It's usually not you do one or the other. It 19 usually is a combination of a number of things. 20 So, you think about consumer education, you 21 think about what the technology can do, you think about 22 what the individual companies can do, and you also think 23 about regulation and legislation. Each one of these may 24 play some role in the development of this technology,
25 and it's not clear right now what should be assigned to For The Record, Inc. Waldorf, Maryland (301) 870-8025 259
1 which, but what we need to be thinking about are what's 2 the appropriate way of responding to the issues that 3 people have raised so far today. 4 People have started to talk a little bit about 5 the state legislation, and the FTC has I know thought a 6 lot about this, invited some people at the state level 7 to come, and they weren't able to come, but it's one of 8 the ways that people are responding to the issues. 9 Let me just make one point about that, because 10 if you think about this technology, people around the 11 world are going to have access to this technology, and 12 when the people who are driving the technology think 13 about it, they think about global solutions. So, to the 14 extent that we think about solutions to these issues, we 15 should think about them in a global context, and in that 16 context, it's not as if we're kind of writing on a blank 17 slate. 18 When someone asked before, are you going to 19 regulate RFID, there are already rules around the world 20 about some of the issues that have been raised today, 21 whether it's the EU Privacy Directive, and a number of 22 European countries have already said that data collected 23 through these means are subject to the Directive, but it 24 also means spectrum rules, it means health exposure
25 rules for radio frequency, it means individual consumer For The Record, Inc. Waldorf, Maryland (301) 870-8025 260
1 protection laws, whether at the state level or at the 2 federal level or at other national levels. 3 So, it's not as if there aren't kind of already 4 are things in place to address some of these questions. 5 So, as we hope during this panel we'll be thinking about 6 what already exists, what kinds of solutions exist in 7 consumer education, in industry practices, in regulation 8 and technology, to see what fits best at a time when the 9 technology is still evolving and when the goal is to 10 have something that, in fact, operates globally. 11 So, with that in mind, let me turn it back to 12 Tracy as to the order of the speakers, and we'll start 13 right away. 14 MS. THORLEIFSON: Well, I am going to introduce 15 each speaker as they get up to speak, and to begin with, 16 I am very delighted to introduce Mr. James Stafford from 17 Marks & Spencer, who definitely wins the prize for 18 coming the longest way, because he came from England. 19 This panel's title is "Meeting the Challenges: Best 20 Practices and Principles," and we bring you Mr. Stafford 21 because he has met the challenge at his store, Marks & 22 Spencer, and he's here to talk about that. 23 His title, our favorite title of all the 24 panelists, is Head of RFID. So, Mr. Stafford from Marks
25 & Spencer, Head of RFID. For The Record, Inc. Waldorf, Maryland (301) 870-8025 261
1 MR. STAFFORD: All right, thank you very much 2 indeed, and you can be clear from that whose head is on 3 the block if things don't work out very well. It's 4 great to be here all the way from England, and it's 5 about the time now, about five hours ahead, and I would 6 be settling down with a cup of cocoa, be settling down 7 to go to bed. 8 I have spent my whole career involved with 9 innovation and new technology, and a risky business it 10 certainly is. I think that it does seem to me that in a 11 retail context, we really have to be very careful of 12 anything that involves new technology, because on the 13 whole, people are cautious about things which are new. 14 So, I think if you want to deploy new 15 technology, I think you first of all really have to 16 think about engaging with your customers and re-assuring 17 them that the benefits of this new technology outweigh 18 any potential perceived risk of that technology, and I 19 use the word "engage" with care, because "engage" 20 doesn't mean talking to them. "Engage" also means 21 listening to them as well, listening to what they have 22 to say. So, here's what we've been doing using this new 23 RFID technology. 24 That just says here I am in Washington.
25 Okay, just a little bit about Marks & Spencer, For The Record, Inc. Waldorf, Maryland (301) 870-8025 262
1 which you can read on the Web site in the notes. The 2 key things here, established in 1884, we're over a 3 hundred years old. I have been there for a great deal 4 of the time, feels like it. We have got three really or 5 four separate businesses, clothing, foods, homeware and 6 financial services. We have 10 million customers a 7 week. We have 300 stores in the UK and turn over around 8 about $14 billion, and we are the UK clothing market 9 leader. And we have got stores, large stores, 10 departmental stores, High Street stores, stores which 11 specialize in food, and stores which specialize just in 12 homeware. 13 And we're using RFID to drive efficiency in our 14 supply chain, and here, where it does require a little 15 bit of concentration here at this time of the evening, 16 we have got two separate business deployments, because 17 we're using this technology in two different parts of 18 our business. We're using it in foods, and we're using 19 it in clothing, and not surprisingly, because they're 20 different businesses, the business case that drives us 21 to use this technology is different in foods and in 22 clothing, and again, it shouldn't be too surprising that 23 the iteration of that technology is different, because 24 there is not just one RFID technology, as people have
25 said, there are many different types, and we use them For The Record, Inc. Waldorf, Maryland (301) 870-8025 263
1 differently in foods than in clothing. 2 Now, I'm not going to say very much about foods, 3 because -- only really just to kind of boast the 4 technical people here who are really using this thing, 5 that we have already deployed 3 and a half million RFID 6 tags on our returnable food trays, plus some other 7 deployments as well within foods, and these are trays 8 which are filled up with foods by the food supplier, and 9 they are sent through to our stores through a depot and 10 then returned empty back to the food supplier in the 11 first place. 12 The white square on the right-hand side of that 13 tray, underneath that white square is buried the RFID 14 tag, and at the actual supplier, we are writing 15 information to that tag in place of the previous paper 16 label. So, here is a deployment where an RFID tag is 17 being used to replace traditional paper or bar coded 18 labels, and basically every trip, we write to the tray 19 what the contents of the tray is, it's a tray of 20 potatoes, and it's a certain bag size, and it's got a 21 certain potato, got a certain sell-by date, it's 22 probably a particular variety of potatoes, other 23 information is written to the tray, and when the tray 24 comes back empty after the next trip, the next set of
25 props is written to it. For The Record, Inc. Waldorf, Maryland (301) 870-8025 264
1 The advantage of using RFID tags over 2 traditional bar codes is entirely because we can read 3 the RFID tags much more quickly than we can read 4 traditional bar codes. The business case for using RFID 5 tags is entirely around the speed of read, and it's a 6 pretty easy business case to make, because this is a 7 returnable tray situation. These trays last seven to 8 ten years, they make two and a half trips a week, and so 9 you can see the amortization of the tag cost is really 10 spread over something like 1000 to 1500 trips over the 11 life of the tray. So, it's really very easy to make 12 this work for us. 13 But I don't really think, as Katherine said 14 earlier, because this is not some, you know, in the 15 consumer-facing end of the business, that it really 16 actually involves many privacy concerns. 17 When we came to the trials of clothing, we have 18 done our clothing trials on menswear, and this is about 19 item-level tagging. This is about the item-level stuff 20 that you've heard about isn't going to happen for many, 21 many years to come. Well, welcome to the future. Here 22 in London, we are five hours ahead in time and ten years 23 ahead in technology, it appears to be, from what I've 24 heard today, and in this case, this is a read-only
25 implementation of tagging of clothing. We did a trial For The Record, Inc. Waldorf, Maryland (301) 870-8025 265
1 last autumn to test the technology in our store to make 2 sure it worked, and now we've gone on to a larger trial 3 this spring in six stores to prove the business case for 4 using this technology. 5 Why should we be bothered to use this 6 technology, item-level? Well, basically we want to 7 improve the stock availability for our customers, and we 8 believe we can make the supply chain more accurate by 9 using this technology, and of course, it's retail 10 heaven, we have all heard about it, right goods, right 11 place, right time, and that's what we are trying to 12 drive for, but it is also consumer heaven, we believe, 13 because it means that your shopping trips to a store are 14 not wasted, because we'll have, at the very least, the 15 size of the item that you're looking for. 16 We've also tried to really talk about it just as 17 another stock control system and said that really, being 18 a migration of stock control systems from krull pins 19 through Kimball tags and bar codes, and now to the RFID 20 technology, which we are calling the intelligent label. 21 These are our intelligent labels which we're 22 using, which we're hanging on the garments. They are 23 quite large, they are very visible, and if anybody wants 24 one afterwards, I have got a few here, I will give them
25 to you. If you're an RFID vendor, it will cost you a For The Record, Inc. Waldorf, Maryland (301) 870-8025 266
1 hundred dollars. It's all about small volumes, you 2 know, high prices. But we also try very hard to 3 communicate both to our staff and to our customers about 4 what this technology is all about, and we made a video 5 which we made early this year to try and get the message 6 over. 7 (Videotape played for the workshop 8 participants.) 9 MR. STAFFORD: That's the -- oh, we don't want 10 to do it again, do we? Now we're completely losing it. 11 Let's just -- I just can't get rid of it. Somebody help 12 me. Oh, click out there, that's a good idea. There we 13 are, excellent, sorry. 14 Anyway, the video has been useful. A number of 15 people commented it would have been even better if it 16 had some decent actors, but we did have a budget. 17 Just a few words about this to really emphasize 18 some points made by the video. Again, as we have all 19 talked about, the information on the tag is just a 20 unique number plate. We are not writing any information 21 at all in this deployment to the tags. So, on our 22 central database, we are kind of matching up the tag 23 number and the information about the garment, about the 24 size, style and color.
25 Even if you get the tags and can read them, For The Record, Inc. Waldorf, Maryland (301) 870-8025 267
1 eventually you could hack into our database, again, all 2 you'd find out was that there was a certain garment of a 3 certain style and a certain color. There is no customer 4 information ever recorded on these tags, and 5 furthermore, we're not even reading the tags at the till 6 points, so there can never be any confusion about what 7 we're actually doing. 8 Here's a tag, as we've shown you, on a garment. 9 It's fairly obtrusive. It's a bit too large. You want 10 it to be visible, but it sticks up behind people's necks 11 when they are trying the garments on, but at least it 12 does the job. 13 Here is the mobile scanner built into a Marks & 14 Spencer shopping trolly. This is Mark II. Mark I had 15 smaller wheels, and it is now on bigger wheels, and we 16 have a Mark III in development, which I can't show you a 17 picture of, but don't hold your breath, because the 18 current nickname for it is called Lunar Lander. But 19 this is the reality about what you need to do to deploy 20 the technology. 21 Most importantly, we've provided in our stores 22 and on display in the current trial is a leaflet for the 23 customers, which basically has two sides, a first side 24 that tries to explain a bit about the technology. The
25 second side, most importantly, talks about our For The Record, Inc. Waldorf, Maryland (301) 870-8025 268
1 commitment to our customers, and it talks about our 2 responsible use of the technology, and we're committing 3 ourselves to say they will be clearly identified, these 4 intelligent labels. 5 They do not contain a battery. They are 6 passive. Customers do not need to keep the intelligent 7 labels to return or exchange items. We have a very 8 generous refund policy at Marks & Spencer. You can buy 9 anything from any of our stores at any time and you can 10 bring it back at any time and get a full refund, even 11 without a receipt. So, we do take back a lot of items 12 from our customers, although we are lucky they keep some 13 of them, but basically, whether you've got the RFID 14 labels or not, it doesn't affect our refund policy. 15 We will not link any garment information on the 16 intelligent label with customer details, and we will not 17 scan intelligent labels at the till, and you may, as a 18 customer, of course, throw away the intelligent label 19 after purchase. 20 Furthermore, we will also remove the intelligent 21 labels at the till point if you request it. All the 22 staff are briefed to do that, and that is what we're 23 doing now, and I think that's the end of my 24 presentation.
25 Thank you. For The Record, Inc. Waldorf, Maryland (301) 870-8025 269
1 MS. THORLEIFSON: Thank you. 2 Our next presenter is Elizabeth Board, and she 3 is with the EPC Public Policy Action Committee and has 4 done a number of wonderful things in communications and 5 public affairs, which if you want to read about, check 6 the bios. 7 MS. BOARD: Thank you, good afternoon. 8 We've been listening to a lot today since my 9 colleague spoke at 8:30 this morning, Sue Hutchinson. 10 She talked about the technology behind EPCglobal. I'm 11 going to talk a little bit about the organization 12 itself, not the technology. I'll also talk about our 13 public policy guidelines that address privacy issues, 14 and I'll encourage all of us to continue the dialogue 15 that's been started here today. 16 First of all, what is EPCglobal? It's a joint 17 venture of the Uniform Code Council and EAN 18 International. We're new. We were just formed in 19 November of 2003. We're charged with taking the 20 electronic product code from its development at MIT to 21 the global marketplace, and our mission is simply to 22 create global standards for the EPCglobal Network, or as 23 you've heard many times today, the next generation bar 24 code.
25 UCC and EAN International are the perfect For The Record, Inc. Waldorf, Maryland (301) 870-8025 270
1 parents to have for this venture. They have 30 years of 2 experience developing and managing business-to-business 3 standards. Examples include, of course, UPC or bar code 4 standards and electronic data interchange standards for 5 information flow. They are a global organization 6 representing more than 100 countries, and the bar code 7 standards are used by more than 1 million members, and 8 this translates into 10 billion bar codes scanned every 9 day worldwide. 10 Our vision is efficient global commerce for the 11 ultimate benefit of the consumer. And I'm proud to say 12 that EPCglobal has now over 200 members. That's not a 13 million, but it's only been since November. 14 Our business is based on some important 15 principles and beliefs. We're a not-for-profit 16 organization. We're neutral. That means we represent 17 manufacturers, retailers and solution providers. We are 18 standards-driven. Our standards process is open and 19 inclusive. We're serving all companies, from large 20 multinationals to small business, and in every business 21 sector, every industry sector. And of course, we have a 22 global perspective. 23 We offer -- actually, I am going to skip over 24 these slides on today and tomorrow, because you've heard
25 a lot about what EPC offers today and what it could For The Record, Inc. Waldorf, Maryland (301) 870-8025 271
1 possibly open tomorrow. I just want to say one thing 2 about where we are today. 3 If you look at the history of the bar code, at 4 this time in its development, it was drowning in urban 5 myths. In fact, many of the original urban myths 6 involved the bar code. If there was a museum on the 7 mall for urban myths, the bar code would have an entire 8 floor. 9 In 1975, I was producing a talk show in 10 Washington, D.C., a radio talk show, and whenever the 11 phones would be dead on a holiday weekend or something, 12 I would call up my roommates and say, call in about the 13 bar code, and in five minutes, the phones would be lit, 14 and the debate would go on. 15 But now, they're everywhere, and no one gives 16 them a second thought, and why is that? It's because 17 retailers never did any of the things the urban myths 18 said they were going to do, and the reason is because 19 it's not in the retailer's best interests to do anything 20 that would make the customer feel uncomfortable. 21 That's why one of the first things EPCglobal did 22 when it was formed last fall was take over the privacy 23 guidelines that had been developed at MIT. These were 24 developed with input from consumers and privacy experts,
25 and they're managed at EPCglobal by a public policy For The Record, Inc. Waldorf, Maryland (301) 870-8025 272
1 steering committee. 2 This part of EPCglobal is very important. In 3 fact, you can see on our org chart that privacy is as 4 important as anything we do. It's right there on the 5 same level with our technology steering committee and 6 our business steering committee. This is the business 7 that we're in, and privacy is absolutely a part of it. 8 Public policy guidelines have four critical 9 elements: Consumer notice, consumer choice, consumer 10 education, and of course, our members follow all rules 11 recording all legislation, regulations regarding record 12 use, retention and security. Our subscribers agree to 13 adopt these guidelines, and they're being used today in 14 the consumer test phase. 15 Simon showed you some of the ways that Wal-Mart 16 used consumer notice in their test recently. On the 17 slide now is the tag that was actually put on the 18 printer box, as you saw that, and Sandy showed you the 19 actual shelf talker, but they did more than that, and 20 that's why I wanted to bring it up. 21 They also had a press conference at Wal-Mart. 22 They invited cameras into the store. They did as much 23 as could possibly be done to let people in the local 24 community know that something different was going on.
25 It's important to understand about our For The Record, Inc. Waldorf, Maryland (301) 870-8025 273
1 guidelines, because they will evolve over time as the 2 technology evolves. These guidelines are for right now, 3 while we're in the testing phase. We're going to need 4 to do things with these guidelines, and that's what the 5 public policy committee is charged with. The guidelines 6 are part of the classic technology launch; develop, 7 launch, learn, refine and improve over time. We will 8 continue to participate in public dialogue and listen to 9 consumers and all of you as we responsibly and ethically 10 deploy EPC technology. 11 So, in conclusion, I've just made four key 12 points here today. We're a neutral, nonprofit 13 organization driving efficiency in the global supply 14 chain. Our members follow public policy guidelines for 15 responsible use. EPC is in the early stage of 16 development, and urban myths can stifle innovation. And 17 finally, I hope we continue the public dialogue, and I'd 18 like to thank the FTC for this opportunity today. 19 Thank you. 20 MS. THORLEIFSON: Thank you. 21 Our next panelist is Cedric Laurant, who is 22 Policy Counsel with EPIC, the Electronic Privacy 23 Information Center, where he's concentrated on a number 24 of privacy issues, including profiling air travelers,
25 video surveillance and government electronic For The Record, Inc. Waldorf, Maryland (301) 870-8025 274
1 surveillance. He's also supervising production of the 2 2004 edition of Privacy and Human Rights. So, Cedric. 3 MR. LAURANT: Thank you very much. Actually, I 4 would like to thank the Federal Trade Commission for 5 inviting the Electronic Privacy Information Center to be 6 a participant to this panel. 7 What I am generally going to talk about is 8 probably a little bit boring. It's the guidelines, the 9 privacy principles that should guide RFID users and 10 retailers in the way they implement RFID tagging on 11 individual consumer products. 12 I think the Federal Trade Commission has a very 13 important role to play to protect consumers' interests, 14 and in that regard, we came out with a set of guidelines 15 establishing rights and duties for consumers and RFID 16 users that you can find on the table outside, that some 17 of you may have already picked up, and that's available 18 online on our Web site at epic.org. 19 I am going to refer to a few instruments, 20 international instruments and guidelines that have been 21 released recently that show that there are many privacy 22 experts and many legislative bodies that have taken a 23 strong interest in how RFID tags raise very strong 24 privacy concerns for the consumers and that show very
25 clearly that RFID tagging should be regulated or there For The Record, Inc. Waldorf, Maryland (301) 870-8025 275
1 should be guidelines that prevent the businesses from 2 intruding into consumers' privacy. 3 The first guidelines refer to the Data 4 Protection Privacy Commissioners. It's a resolution 5 that the Data Protection Privacy Commissioners came out 6 with in November last year, and those guidelines say 7 very explicitly that RFID design, implementation and use 8 must be based on basic principles of data protection and 9 privacy law, and they basically say that any RFID user 10 should first consider alternatives which achieve the 11 same goal without collecting personal information or 12 profiling customers. 13 They also say that data must be collected in an 14 open and transparent way, that the data may only be used 15 for the specific purpose for which they would first 16 collect it and only be retained for as long as is 17 necessary to achieve or carry out this purpose; that 18 whenever RFID tags are in the possession of individuals, 19 these customers should have the possibility to delete 20 the data and to disable or destroy the tags. 21 Another very important reference is the 1980 22 Organization For Economic and Corporation Development 23 Guidelines and Principles, as well as the American 24 Principles of Fair Information Practices. These
25 guidelines establish eight privacy principles. For The Record, Inc. Waldorf, Maryland (301) 870-8025 276
1 The first one is the collection and mutation 2 principle, which requires limits to the collection of 3 personal information and the obtaining of any data by 4 lawful and fair means with the knowledge or consent of 5 the subject, the data collection principles, that 6 stipulates that personal data should be relevant for the 7 purposes for which they are to be used, and they should 8 be accurate, complete and up to date. 9 The personal specification principles establish 10 that the purposes for which personal data are collected 11 should be specified not later than at the time of data 12 collection, and the subsequent use should be limited to 13 fulfill those purposes. 14 There's also a use limitation principle, 15 security safeguard principle and openness principle, and 16 this one is very important. It states that there should 17 be a general policy of openness about developing 18 practices and policies with respect to personal data, 19 which means as far as RFID implementation is concerned 20 that there should not be any secret databases. There 21 should be no tag reading in secret. The label should be 22 clearly displayed and easily understood by consumers. 23 There is also an individual participation 24 principle, which states that consumers, customers who
25 purchase RFID tags, should have the right to ascertain For The Record, Inc. Waldorf, Maryland (301) 870-8025 277
1 or confirm whether an RFID user has data relating to him 2 or her and to challenge the data, to be able to amend or 3 correct that data. 4 There are also accountability principles that 5 state that there must be, as applied to the RFID 6 industry, there must be entities in both industry and 7 government to whom individuals can complain when these 8 provisions have been violated. 9 Several civil liberties groups released a 10 position, a policy position on RFID last November 2003 11 in which they enumerated practices that should 12 absolutely be prohibited. Merchants, they said, should 13 be prohibited from forcing customers into accepting live 14 or dormant RFID tags in the produce they buy. There 15 should be no prohibition on the individuals to detect 16 tags and readers and disable the tags on items in their 17 possession. Human tracking, they said, is 18 inappropriate. RFID should never be employed in a 19 fashion to eliminate or reduce anonymity. 20 So, the guidelines EPIC came up with incorporate 21 those fair information practice principles and the 22 principles that were enumerated in the civil liberties 23 group's statement. 24 I'm going to go over them very quickly, but
25 what's important, what I would like to stress about For The Record, Inc. Waldorf, Maryland (301) 870-8025 278
1 those guidelines is that the first part addresses the 2 duties of private enterprises that use technology in a 3 way that's analogous to bar codes. A second point that 4 addresses the duties of private enterprises who go a 5 step further and use the RFID technology in a way 6 analogous to loyalty cards, where personal information 7 stored on the tags potentially contain a profile of the 8 customers, and finally, a part three that states the 9 rights of consumers who are exposed to RFID technology. 10 So, in this part one, what's important is the 11 fact that RFID users should give notice to an individual 12 of the presence of an RFID tag. Labeling should be 13 reasonably conspicuous to the individual, and you should 14 state at a minimum that the product, in fact, bears an 15 RFID tag, that the tag can transmit unique 16 identification information to an independent reader both 17 before and after the purchase and should also contain 18 basic technical characteristics of the RFID technology. 19 RFID users should also not track the movement of 20 individuals on the premises or outside the premises. 21 The second part establishes the duties that an 22 RFID user using RFID system should follow when those 23 RFID systems gather personal data about an RFID subject. 24 I don't have time to go over them, but you can find
25 these guidelines outside on the table and online on the For The Record, Inc. Waldorf, Maryland (301) 870-8025 279
1 Web site. 2 And just briefly, to explain the state of 3 legislation outside of the United States, which may have 4 an impact on how personal data being processed in the 5 United States, the major one being the EU Data 6 Protection Directive and the EU Directive on privacy and 7 communications, which contrary to what Sandy Hughes said 8 previously, is very clear about how information 9 processed by RFID tags should be regulated. There's no 10 doubt about this. Those two EU directives clearly apply 11 to information that's processed by tags. 12 There are also Japanese and Italian guidelines 13 that recently came out. So, what we would like the 14 Federal Trade Commission to do is to take a look at 15 those guidelines and try to push the companies to adopt 16 them, to push companies to post privacy policies that 17 embody a set of guidelines that provides consumers with 18 the possibility to actually enforce them, and if there 19 is any abuse related to the data, their data, the 20 processing of that data by RFID tags, the FTC should 21 ensure that consumers can actually obtain compensation 22 for this abuse. 23 Thank you very much. 24 MS. THORLEIFSON: Thank you. And just a
25 reminder to everybody, I know it's late in the day, but For The Record, Inc. Waldorf, Maryland (301) 870-8025 280
1 if you have burning questions or suggestions, to write 2 them down and send them up. 3 Our next panelist is Paula Bruening, who is the 4 Staff Counsel for the Center For Democracy and 5 Technology, and she specializes in privacy and free 6 expression issues. She is going to bring us some more 7 thoughts on best practices. 8 MS. BRUENING: Thank you. 9 Today's panels I think -- well, first of all, I 10 should tell people who CDT is. I give these talks a 11 lot, and I assume people know, but the Center For 12 Democracy and Technology is an independent advocacy 13 organization, we're nonprofit, and we advocate for free 14 expression, user empowerment and privacy on the 15 internet, and as Tracy said, a lot of my portfolio with 16 CDT is privacy, and I have been working in the area of 17 privacy for about ten years now, and I think today we've 18 heard a lot about the potential of RFID, and there is a 19 lot of consensus that there is a lot of good that can 20 come from this technology. 21 I think there's also a lot of agreement that the 22 technology does raise privacy concerns, and whether or 23 not we agree on how one would characterize those 24 concerns, I think there is an understanding that if
25 consumers and users don't trust this technology, if they For The Record, Inc. Waldorf, Maryland (301) 870-8025 281
1 don't trust it as being used appropriately, that the 2 information is being collected and used responsibly with 3 respect to privacy, they aren't going to accept the 4 technology and the many good things that can come from 5 it. 6 So, I would say that any decision about 7 addressing privacy -- and there is clearly a drive to do 8 so -- must be based on sound analysis, on the input of 9 all stakeholders, on reliable information, and on a 10 clear understanding about the technology, both its 11 potentials and its implications and risks, but already, 12 we're seeing a lot of movement toward establishing some 13 kind of principles, guidelines, best practices for 14 privacy and this particular technology. 15 We have heard about industry efforts through 16 EPCglobal and their standard-setting process; we've 17 heard now about EPIC's principles; and legislatures are 18 now looking very closely at this now that consumers' 19 concerns are being raised about privacy. I think what 20 lurks under all of these efforts is the concern about 21 possibly institutionalizing solutions to privacy that 22 have unintended and unforeseen consequences that are in 23 the end going to stifle either the proliferation of the 24 technology for the good uses that can come of it or
25 institutionalized mistakes about how we address privacy For The Record, Inc. Waldorf, Maryland (301) 870-8025 282
1 and in ways that don't foresee the possible things that 2 could come of the information collection and the 3 reactions of users to privacy concerns that it raises. 4 So, how do we go about addressing this? I'm 5 going to talk about two things briefly. First, I'm 6 going to talk a little bit about technology assessment, 7 and as a matter of full disclosure, I will say that I am 8 a graduate of the Congressional Office of Technology 9 Assessment that you have heard a lot about today. I 10 worked there for five years, and it was a very good 11 experience. It is an organization that was not without 12 its critics, as many of those criticisms were well 13 placed, and I'll comment on a couple of those as I talk 14 about technology assessment, but I think there's a lot 15 of good that can come from it, and I would just like to 16 raise a couple of points on that. 17 Technology assessment, an assessment of RFID 18 that draws out an understanding of the technology, of 19 how it works, its potential to serve users, and the 20 vision of the future for the technology, how it might 21 proliferate and develop, and the risks that it raises, 22 could provide the analytical underpinnings that would 23 really drive very sound solutions, the best possible 24 solutions to address privacy.
25 Such an assessment would benefit from the input For The Record, Inc. Waldorf, Maryland (301) 870-8025 283
1 of a wide range of stakeholders, experts, technologists, 2 who could really bring to bear some of the best thinking 3 about this issue. As we've heard today, a lot of these 4 efforts are already ongoing. We have heard that things 5 are going on out at Berkeley. There are industry 6 surveys that have gone on, industry outreach, different 7 kinds of efforts in terms of developing guidelines, 8 learning more about the technology and its 9 ramifications, and so I think there are a lot of pieces 10 of this work that are already ongoing and that what's 11 needed is really a centralized point where all of this 12 could be brought together and where some of that neutral 13 analysis could take place and be brought to bear. I 14 think there was a comment in an earlier panel about, 15 well, we don't really need neutral analysis, that we 16 will let the market figure all of this out, and I think 17 that it's really important to understand what that 18 neutral analysis means. 19 First of all, if you do technology assessment 20 well, you aren't going to come out with solutions. The 21 point of technology is not to drive to the fastest 22 solution that's going to make a certain segment of 23 stakeholders happy. What infuriates many people about 24 it is that you don't come out with any kind of answer.
25 You come out with road maps, you come out with For The Record, Inc. Waldorf, Maryland (301) 870-8025 284
1 possibilities, and you come out with what's the 2 consequence if you act in certain ways on the basis of 3 what we know about a technology. 4 I think that the other point that I would make 5 is that if you do it fairly, technology assessment 6 generally makes everybody a little bit angry and 7 everybody a little bit happy. I think I really 8 thickened my skin working at OTA, but inevitably, 9 whatever we published got heavy criticism and a lot of 10 praise at the same time, and they often came from the 11 same people, and I think that that's an important thing 12 to remember, whatever side of the debate that you're 13 sitting on, is that whatever you come out with at the 14 end of this process, we'll all have learned a lot more, 15 but we may not all be happy with all of the outcomes of 16 what we find. 17 The second point that I wanted to talk about, 18 since time is limited, is best practices. I'm really 19 excited to hear about all of the work that's going on 20 creating guidelines, creating some of these high-level 21 principles, and I think what's really important going 22 forward is to build on that effort and to start to bring 23 those 30,000-foot efforts down closer to where the 24 technology is being used and down to more practical
25 applications. For The Record, Inc. Waldorf, Maryland (301) 870-8025 285
1 I'll just point out one example. We've talked a 2 lot about how it's really, really important that 3 consumers get good notice about what this technology is, 4 how it works, what its benefits are and how they can 5 control the information collection around RFID, and 6 we've talked about consumer education, and I would say 7 that we've had enough experience at this point in the 8 area of providing notice to consumers that we know that 9 in different kinds of environments with different kinds 10 of technologies, this exercise can be really, really 11 challenging, and I think that this is a place where 12 we're going to have to do some very creative thinking 13 about how you provide notice to consumers about an 14 invisible technology that provides very passive kinds of 15 data collection, and conveying to consumers in a 16 meaningful and effective way what's happening is going 17 to be a big challenge, and I think you could take that 18 similar analysis when you start talking about things 19 like providing choice and providing accountability. 20 To make this happen requires all stakeholders 21 sitting around a table and really rolling up their 22 sleeves and doing some very hard thinking about how 23 those very important principles that have been discussed 24 here today are applied in practice. I think that it can
25 be an effort that is labor-intensive, but if we get to For The Record, Inc. Waldorf, Maryland (301) 870-8025 286
1 work on it quickly, we can come up with at least a first 2 iteration of something that will work, that we can take 3 to the marketplace and implement quickly, and as 4 Elizabeth said, continue to refine, continue to think 5 about this, and continue to figure out what's going to 6 be best for us moving forward. 7 To arrive at these best practices really 8 requires a concerted effort of all stakeholders and 9 interested parties, but I think that if we do the hard 10 work now, we can come up with something that is going to 11 serve both consumers and businesses and I think 12 importantly is going to inform further decision-making 13 about policies about privacy around RFID for the future. 14 Thank you. 15 MS. THORLEIFSON: Thank you, Paula. 16 Our next panelist is Rob Atkinson. Mr. Atkinson 17 is Vice President of the Progressive Policy Institute 18 and Director of PPI's Technology and New Economy Project 19 and the author of many other things, but he's here to 20 talk to us about meeting the challenge in best 21 practices. 22 MR. ATKINSON: Okay, thank you. I want to thank 23 the FTC for holding this panel, because I think it's an 24 important issue.
25 I have to admit right away, just so you know For The Record, Inc. Waldorf, Maryland (301) 870-8025 287
1 where I'm coming from, I am an RFID advocate and user. 2 I have my smart card, so if anybody wants to know where 3 I went on the Metro recently, just log into their 4 database. I have my key card, if you want to break into 5 PPI, just scan that. I also have my Mobil SpeedPass to 6 tell you where I've been recently. And not only that, 7 but I have not one but two grocery store loyalty cards, 8 and unfortunately, they don't have RFID in them, so I 9 don't think you can track them. 10 I want to make four points today. The first 11 point is, I often wonder whether we would even be having 12 this kind of conversation about a really important 13 innovative technology that's going to improve our 14 economy and give consumers choices if it weren't for 15 what I would say are some privacy advocates who are 16 trying to make this out as a major crisis in our lives, 17 and let me just give you a few examples of that. 18 Before I do that, actually, I think, you know, 19 given how big the benefits are to consumers, given how 20 big the benefits are in terms of productivity, access to 21 quality items and stock, as our Marks & Spencer 22 colleague pointed out, the only way consumers are going 23 to be convinced that somehow they should avoid this 24 useful and innovative, cost-saving technology is to
25 somehow raise the spector of all sorts of terrible For The Record, Inc. Waldorf, Maryland (301) 870-8025 288
1 things that are going to happen. 2 Let me just give you a few examples. These are 3 not, for example, from the aluminum foil hat group. 4 These are actually legitimate privacy groups have said 5 these things. Cedric said on his Web site, "Chips 6 integrated into commonplace products such as floor 7 tiles, shelf paper, cabinets, appliances, exercise 8 equipment and grocery and package products would allow 9 even our most intimate activities to be monitored." 10 All right, I have to tell you, I don't really 11 use my Exercycle in my house, and I often times eat 12 Hostess Twinkies at night, so now you know. 13 The position statement on the use of RFID on 14 consumer products issued by CASPIAN warns, "When a 15 consumer purchases a product with an EPC-compliant RFID 16 tag, information about the consumer could be added to 17 the database automatically. Additional information 18 could be logged in the file as the consumer goes about 19 her business." Entered Atlanta courthouse, 12:32, at 20 the Mobil gas station at 2:14. So, I guess Wal-Mart 21 will know when I go to buy Mobil gas. 22 UNIDENTIFIED SPEAKER: Is this constructive at 23 this time of day, castigating people? 24 MR. ATKINSON: They also go on to warn about
25 kill tags. They say, "Stores would only pretend to kill For The Record, Inc. Waldorf, Maryland (301) 870-8025 289
1 a tag when they would make it dormant and later 2 reactivate." So, obviously we shouldn't even pursue 3 kill tags, because stores will lie to us about the kill 4 tag. Knowing that, the government will probably pass a 5 law -- given the Congress, no, they're highly likely to 6 pass a law, to quote, "prevent stores from killing 7 them," and thereby create, "a surveillance society." I 8 know that the Kerry Administration, if it comes about, 9 and certainly the Bush Administration, that's top on 10 their priority list. 11 Third, Barry Steinhart, Director of Technology 12 program at ACLU, wrote an article in CIO Magazine where 13 he warned that -- basically he was trying to give the 14 male opposition to RFID, he warned, "Imagine strolling 15 around a city one evening and you happen upon a sex shop 16 and pause for a moment to snicker at the curious items 17 in the window. You continue on your way. Unbeknownst 18 to you, the store customer ID system has detected an RF 19 signal emitted by a computer chip in one of your credit 20 cards and recorded your identity. A few weeks later, 21 you're surprised to find in the mail a lurid 22 solicitation from the store mentioning your visit. 23 You've got some explaining to do." Well, I know that 24 one of the major things sex stores do is provide
25 personally identifiable information (PII) on their For The Record, Inc. Waldorf, Maryland (301) 870-8025 290
1 customers so they can get them to come back. 2 The last one is one that Jim Waldo mentioned 3 about the RFID rifle on the Web site. You can laugh at 4 that, but John Gilmore, who's a board member of EFF, 5 Electronic Freedom Foundation, he scoffed at the rifle 6 idea, but he did say this, he said, "People with RFID 7 chips in their clothing, books, bags or bodies could be 8 targeted by smart projectiles that will zero in on that 9 particular tag." This is something we will probably use 10 to get Osama Bin-Laden, we will get him to wear some 11 Benneton clothing. 12 He also goes on to state, "Imagine being able to 13 bury an explosive in a roadway that would only go off 14 when a particular car drove over it. You could bury 15 these bombs months in advance on any major or minor 16 roadway. You could change the targeting whenever you'd 17 like. You can give a whole list of cars that would 18 explode." I think it would be a little hard to dig up 19 Interstate 95 and put an RFID tag, reader in there, and 20 pour the concrete that night, get it all nice and smooth 21 before the next day, but you know, who knows? 22 So, in other words, look, what this debate is 23 really about is let's scare the American public, let's 24 scare regulators, let's scare legislators, because this
25 is an awful technology. The reality is, most of that's For The Record, Inc. Waldorf, Maryland (301) 870-8025 291
1 technologically impossible, most of it's practically 2 impossible. The Wal-Mart database is not linked up to 3 the Mobil database, so Wal-Mart doesn't know when I go 4 to Mobil. Mobil knows, but I'm okay with that. 5 Even if technically and practically feasible, 6 which they're not, none of these scenarios will ever 7 happen. Companies, the last thing they want to do is 8 share that information. And the really good thing about 9 this is any egregious practices that companies will do, 10 such as surreptitious reading and other things like 11 that, the really good thing about all these privacy 12 groups -- and it's things that I've given them credit 13 for in the past and will give them credit for in the 14 future -- is they're out there every day eating, 15 breathing, and sleeping this stuff. So, any time 16 somebody violates what are considered as reasonable 17 things, they are going to be out on their Web pages, be 18 on the front page of The Washington Post. 19 The second point they make is that these 20 technologies will link product purchases to PII, and I 21 really think this is a red herring. Every time I use a 22 credit card, I link product purchases to PII. We've 23 been doing it for 30 years. Most Americans have a 24 credit card. Most Americans are pretty happy with that.
25 If they're not happy with it, they can pay in cash. For The Record, Inc. Waldorf, Maryland (301) 870-8025 292
1 Third, I think most Americans really don't care 2 about this. I think they see there's no real problem. 3 There are no real harms with bar codes. There are no 4 real harms with credit cards. They use the stuff, and 5 they use it for a pretty simple reason, because it 6 provides them with real benefits in their daily lives. 7 But that's not good enough, so what privacy 8 advocates want to do is basically make the millions of 9 Americans who are happy with this technology to pay 10 extra money, because if we delay RFID or if we add costs 11 by making the chips so complex to serve all these 12 privacy functions, the cost is going to go up and we are 13 going to significantly reduce the benefits. 14 Finally, I think in terms of what should public 15 policy do, I think right now, public policy should 16 certainly not consider legislation. I think the main 17 thing we need to be looking at is is the industry likely 18 to proceed along the lines of providing notice, choice 19 when that's feasible, and I think they are, and until 20 proven otherwise, I don't think there's a role for 21 government to basically step in and do anything. 22 I do think, though, that there are two roles the 23 government has in this area. One is to be an advocate 24 for the technology. One is to say, this is an important
25 technology that's going to help boost American For The Record, Inc. Waldorf, Maryland (301) 870-8025 293
1 productivity and make our lives better, so that we can 2 all understand it. The second thing is to work closely 3 with groups like EPCglobal, to make sure that they are 4 doing things like making sure that there are privacy 5 notices and that there is no surreptitious tracking. I 6 completely agree with people that say that surreptitious 7 tracking is bad. If you are going to have a reader, it 8 ought to be out in the open. 9 If it turns out that surreptitious and rogue 10 tracking is possible, which is a highly debatable point, 11 we can pass laws against that, just like we've passed 12 laws against using cell phone cameras in bathrooms. Did 13 we outlaw cell phone cameras? No, absolutely not. 14 So, in closing, I would just close by saying I 15 think it's way too early to even consider any type of 16 legislation. This is a technology that's going to have 17 significant benefits for Americans, and we ought to just 18 let it evolve. 19 Thank you. 20 MS. THORLEIFSON: Thank you. 21 Our final panelist, who is going to address some 22 of the ways that the technology is evolving, is Dr. Ari 23 Juels, who is a principal research scientist at RSA 24 Laboratories, where he oversees the various data
25 security projects of the Applied Research Program. Go For The Record, Inc. Waldorf, Maryland (301) 870-8025 294
1 ahead. 2 DR. JUELS: Okay, thank you, Tracy. 3 It's probably fitting that I'm the last speaker 4 of the day, because I would like to contradict most of 5 what was said over the course of the day now. 6 There has been a polarization among panelists 7 into two camps, into the privacy advocates who view live 8 RFID tags as an absolutely pernicious state of affairs 9 if placed in the hands of consumers, and then industry 10 advocates who pooh-pooh the privacy concerns that the 11 advocates have brought forth. 12 One question that was posed by the audience to 13 the previous panelists was whether it was possible to 14 have live tags in the hands of consumers and to achieve 15 privacy at the same time. In other words, can we strike 16 a balance between privacy and utility? And I'd like to 17 suggest that the answer is quite possibly yes and would 18 like to give you a glimpse of a technical vision for how 19 to achieve this. I think that we need some 20 complementary legislation, but as a technologist, I am 21 going to talk about this primarily from the technology 22 side and talk about a possible way of achieving this 23 balance. 24 As a computer scientist and a data security
25 specialist in particular, I view RFID in the following For The Record, Inc. Waldorf, Maryland (301) 870-8025 295
1 terms: RFID means that we will have a world with 2 billions of ant-sized computers, tiny computers. This 3 is, in effect, a new type of computing infrastructure. 4 We already have a great deal of difficulty securing the 5 existing computing infrastructure, so we have to pose 6 the question naturally: what are the implications for 7 privacy and security when we introduce all of these new 8 little computers into the world? 9 This is complicated by the fact that these are 10 highly constrained devices from the computational point 11 of view. They carry very little functionality, and in 12 particular, they're unable to perform many of the data 13 security functions that we're accustomed to employing in 14 securing existing computer networks and computing 15 devices. For instance, they can't perform encryption, 16 and in fact, even if they could, encryption wouldn't 17 solve most of our problems, as I'll discuss in the next 18 slide. 19 As we've discussed over the course of the day, 20 they are subject to clandestine scanning and mobile and 21 personal. These are particular complications here, and 22 computer security is already fairly hard in general. 23 On the other hand, we've already managed to 24 secure a world with a broad array of computing devices,
25 everything from mainframes to PDAs, and what we've seen For The Record, Inc. Waldorf, Maryland (301) 870-8025 296
1 is that with good tools and foresight, we can at least 2 achieve adequate computer security, and I think that we 3 can achieve adequate security and privacy with respect 4 to RFID. 5 A key thing to observe here is that in places 6 where we didn't plan well in advance, we're paying the 7 price now with regard to viruses, for instance, and 8 general hacking attacks, denial of service, trojan 9 horses. We didn't think in advance about these security 10 problems, and they've become extremely problematic and 11 costly now. So, it's incumbent upon technologists to 12 try to address future concerns even before the 13 technology really gets off the ground. 14 Let's cast our minds forward to, say, the year 15 2015 or whenever it may be when individual RFID items 16 are, in fact, tagged, and there's been a great deal of 17 skepticism regarding the ability to scan tags when 18 carried by a consumer, because of problems with UHF 19 tags, for instance, encountering interference from 20 liquids, human beings being liquids, and so on and so 21 forth, but we're essentially arguing about video 22 surveillance in the age of the daguerrotype. We don't 23 know exactly how this technology is going to evolve, and 24 there will undoubtedly be advances that will make
25 scanning more effective. So, let's think about the For The Record, Inc. Waldorf, Maryland (301) 870-8025 297
1 implications. 2 We've already talked about several scenarios in 3 which consumer privacy might be violated. This slide is 4 an attempt to encapsulate some of the possible risks. 5 An ordinary consumer like Mr. Jones here can be subject 6 to scanning of a number of embarrassing items, and in 7 some cases, of items that might actually pose a risk to 8 his personal safety. For instance, the European Central 9 Bank is purportedly considering plans to embed RFID tags 10 in Euro bank notes, so you can imagine a mugger scanning 11 for Euro bank notes and selectively mugging. 12 I think that the focus on databases actually 13 over the course of the day has actually been misguided 14 to a certain extent. The information described in this 15 slide is actually available in the RFID tags themselves. 16 They carry manufacturer codes and product codes in 17 addition to unique identifiers. 18 The suggestion has been that people will not be 19 able to decipher these codes because they won't be able 20 to access the databases that contain the codes, but 21 these codes will be standardized, and it will not take 22 very long for somebody to figure out that 123 means 23 Coca-Cola. It's on all of the tags, it's part of a 24 standard, and it will be in a database that will be
25 accessible to every single member of EPCglobal, of which For The Record, Inc. Waldorf, Maryland (301) 870-8025 298
1 there will be hundreds. 2 There's also been the suggestion made that we 3 can simply encrypt these numbers in order to protect 4 them, but encryption is a red herring here. If you 5 encrypt the number 1-2-3, you will get another number, 6 perhaps it will be 8-9-7. It won't take people too long 7 to figure out that 8-9-7 means Coca-Cola. So, 8 encryption doesn't quite solve the problems. 9 There's also the suggestion that all of the data 10 being scanned from RFID tags will be contained in 11 databases and protected from a legal standpoint by a 12 privacy policy, but even if the manufacturer of the 13 replacement hip here has a very stringent privacy 14 policy, there is still a problem if somebody else scans 15 the replacement hip and doesn't have a privacy policy in 16 force, and then whom is the FTC going to prosecute? Or 17 if the gentleman is hit over the head and mugged because 18 of the RFID tags in his Euro bank notes, who is going to 19 be prosecuted? Those are questions that we have to 20 contemplate. 21 Then, of course, there's the problem of tracking 22 to the unique serial numbers and the possible 23 association with consumer identities. 24 We've already discussed at great length over the
25 course of the day examples of consumer backlash. I For The Record, Inc. Waldorf, Maryland (301) 870-8025 299
1 think a particularly telling statistic, due to Ravi 2 Pappu at Thing Magic, is that some 42 percent of the 3 Google hits on RFID include the word "privacy." 4 One solution that's been proposed over the 5 course of the day is killing of RFID tags, and this 6 appears to make sense. If you kill the tags, of course, 7 dead tags tell no tales, but this also I think is rather 8 a red herring, because RFID tags are much too useful, 9 and I'll explain why I think that is. 10 There's been the implication that consumer 11 choice is going to be the most important tool to bring 12 to bear to defend consumer privacy, but if you give 13 consumers a choice between convenience or lack 14 thereof -- and having RFID tags will be convenient -- of 15 course, they'll choose the convenient option. 16 Moreover, suppose that consumers do choose to 17 have live RFID tags. They shouldn't for that reason 18 abrogate their rights to privacy. 19 Well, I said RFID tags are much too useful. 20 Over the course of the day, we've seen many places in 21 which they're employed. One we haven't seen, curiously 22 enough, is house pets. There are some 50 million house 23 pets in the world with RFID tags. I have a colleague, 24 for instance, who got a cat from a shelter, and it came
25 with an RFID tag. So, when it ran away, the cat was For The Record, Inc. Waldorf, Maryland (301) 870-8025 300
1 scanned and successfully returned to him, and he didn't 2 want the cat back, but he kept getting it back. 3 Okay, we have had many different descriptions of 4 many of the wonderful applications that RFID will bring 5 to consumers. It's a fantastic technology with many 6 benefits that have to be preserved. I won't go over any 7 of these in depth, because we have already learned quite 8 a bit about them. 9 Okay, so, the key message here, and again, I am 10 going to talk about a particular technology, is that 11 embedding of RFID tags, if done naively, may well pose a 12 serious threat to consumer privacy. It's hard to 13 predict the exact degree and nature of that threat, but 14 it will undoubtedly be present, but we can mitigate this 15 problem with the right technology and the right 16 forethought. Let me give you a glimpse of how this 17 might work, for instance. 18 At RSA, in conjunction with Ron Rivest, who is 19 one of the inventors of the RSA CrytpaSystem, for those 20 who are familiar with it, we have developed something we 21 refer to as the blocker tag. You can think of this as 22 itself a kind of RFID tag that creates effectively a 23 sphere of privacy around the consumer. 24 I can't give any technical detail as to how this
25 works due to time limitations, but the idea is that a For The Record, Inc. Waldorf, Maryland (301) 870-8025 301
1 reader tries to scan tags it shouldn't scan, if it tries 2 to scan private tags, the blocker tag will effectively 3 spam the reader. It does this by tricking the reader 4 into thinking that every possible tag in the universe is 5 present, so the reader sees a possible collection of 6 items, several thousand pairs of sneakers and a bunch of 7 dish washers, so on and so forth, and it has to give up 8 scanning. That's how this works. 9 Of course, this would be a disaster if somebody 10 brought it into a supermarket and the blocker works in a 11 naive way, it would cause the supermarket to shut down, 12 but the blocker can be selective, and in particular, the 13 blocker can protect privacy of private items, which is 14 to say items that have been purchased, without 15 interfering with the normal scanning operation in the 16 supermarket. 17 So, this gentleman can purchase his two bottles 18 of merlot, the bottles can be scanned before he's 19 purchased them, but will no longer be subject to 20 scanning after he's paid for them and the bottles belong 21 to him, as long as the blocker is present, but the tags 22 will still remain alive so he can put those bottles in 23 his smart refrigerator and otherwise benefit from the 24 many wonderful features of RFID technology.
25 So, as I say, the blocker tag is selective, it For The Record, Inc. Waldorf, Maryland (301) 870-8025 302
1 will work with a privacy bit embedded in RFID tags, and 2 to be more concrete, in a supermarket environment, all 3 of the tags on items on the shelf would have their 4 privacy bit flipped off. When a consumer purchases an 5 item, the bit would be flipped on, and again, the 6 blocker would only block those items with a privacy bit 7 on until the consumer decides that he or she wants to 8 make use of the tags. 9 These are essentially, these blocker tags 10 themselves, RFID tags. They can be very inexpensive. 11 They can be embedded in shopping bags, in loyalty cards, 12 so on and so forth. Standard integration is extremely 13 helpful here, and we hope that EPCglobal will support 14 this proposal, and in fact, there may well be a good 15 chance of that. 16 I should also say in response to critiques by 17 the privacy advocacy community that we've developed ways 18 of allowing the blocker to enable both opt-in and 19 opt-out approaches, so that there need not be a burden 20 on the consumer necessarily to carry a blocker tag if he 21 or she wants to achieve privacy. 22 We had a blocker prototype demo here today, 23 which I hope some of you had a chance to see, and I 24 should say there are many other technical approaches to
25 the privacy problem. There are also legislative For The Record, Inc. Waldorf, Maryland (301) 870-8025 303
1 approaches, although I would agree that legislation is 2 premature at this point. 3 If you want to learn more about this, here's an 4 unofficial URL for the RSA Labs Web site. Thank you. 5 MS. THORLEIFSON: Thank you. Now we have some 6 questions. First, Elliot. 7 MR. MAXWELL: Let me address this to Marks & 8 Spencer, to the king of RFID. The question is -- two 9 questions came in. Many of Marks & Spencer's policy 10 decisions appear to be driven by UK privacy law. In the 11 absence of similar laws in the U.S., why should 12 Americans expect similar transparency in item-level 13 tagging in the U.S.? 14 Another sort of related question was, what, if 15 any, role did the EU privacy regulatory regime play in 16 the arrangements that you have made with respect to 17 RFID? 18 MR. STAFFORD: Okay, it's not really true to say 19 that our policies are driven by UK privacy law, though, 20 of course, we want to stay within the law. We would 21 like to go a lot further than legislation in terms of 22 what we're doing. The UK European privacy law refers to 23 customer information. We're not about the customer. 24 We're not actually collecting any information about the
25 customer at all. So, we're kind of outside that part of For The Record, Inc. Waldorf, Maryland (301) 870-8025 304
1 the law anyway. 2 But our policies are driven by talking to our 3 own staff, by talking to consumers and talking to 4 consumer groups, and I think that certainly within 5 Europe, after the issues on genetically modified foods, 6 after the issues on BSE, who does the consumer look to 7 in Europe for good advice in terms of complex 8 technologies? And I think that privacy groups and 9 consumer groups have a role to play in taking some of 10 these complex issues and making them simple and 11 highlighting what parity is required. 12 So, I think that what I'm saying really in 13 answer to the question is no, it's not just about the 14 law. It's going beyond the law, and legislation, of 15 course, is behind the real issues, I suspect. 16 MR. MAXWELL: Just as a follow-up question, I 17 assume that Marks & Spencer has a customer loyalty 18 program of some sort, and how do they deal with 19 questions of personally identifiable information in that 20 program? 21 MR. STAFFORD: We have a new -- we do have a new 22 customer loyalty program that's quite new. It works at 23 till points in our stores. I mean, we have a very, very 24 strict policy of never selling any data that we have on
25 our customers to anybody else. So, anything that M&S For The Record, Inc. Waldorf, Maryland (301) 870-8025 305
1 happens to know about you stays within Marks & Spencer. 2 MR. MAXWELL: A question was raised for Paula. 3 I trust that my retailers have little incentive to 4 surveil me outside of the retail setting, so doesn't 5 this alleviate the threat of RFID to privacy? 6 MS. BRUENING: Could you say the end of that 7 question? 8 MR. MAXWELL: I trust that my retailers have 9 little incentive to surveil me outside of the retail 10 setting. Does this alleviate the threat of RFID to 11 privacy? 12 MS. BRUENING: Outside of the -- they have 13 little incentive outside of the -- well, I think that 14 one of the concerns that keeps coming home to me when I 15 hear these discussions is the way that RFID tags are 16 potentially going to be used with loyalty cards or 17 simply used along with credit card information to 18 compile this kind of personally identifiable 19 information. It's a similar kind of collection that's 20 happening in a different way, and it's happening with a 21 technology that I can't see, and I think that that, in 22 itself, is a first line of concern. 23 I don't think it's just about what happens when 24 you leave the store. I think it's about the practices
25 that go on around the technology within the store. So, For The Record, Inc. Waldorf, Maryland (301) 870-8025 306
1 I think to say that -- you know, walking out the door of 2 the store I don't think makes the problem run away. 3 MR. MAXWELL: Rob, the question says, you say 4 that Wal-Mart wouldn't see Mobil's data from the 5 SpeedPass, but won't the EPC system allow exactly that? 6 Aren't both firms going to be using the EPC system? 7 MR. ATKINSON: It's not my impression that they 8 would -- there may be particular codes that are in the 9 EPC database, but why they would have access to the 10 actual database from another company to look at exactly 11 what has been bought, where, when, who, I just don't see 12 that happening. 13 MS. BOARD: All you get from the EPC object 14 naming service, or ONS, it gives you direction on where 15 the server is that holds this information. The 16 information is held at the individual company. And I 17 want to say specifically that it's in these companies' 18 best interests to have incredibly secure data networks, 19 because they don't want their competitors to get any 20 information about their business. So, there is the 21 highest level of security for this information. 22 MR. MAXWELL: There's a comment that was passed 23 in as well from a spokesman from Procter & Gamble, and 24 it says, in response to Ms. Albrecht's comments, we
25 would like to set the record straight. Procter & For The Record, Inc. Waldorf, Maryland (301) 870-8025 307
1 Gamble's Pantene bottle was tested in a laboratory 2 environment only and never reached a retail environment. 3 Procter & Gamble has always supported consumer choice to 4 keep the tag active or to kill it. 5 Let me sort of follow up on a point that was 6 raised by Ari and Rob and also from Cedric in this. The 7 issue of choice on the part of consumers is sort of 8 central to many of the questions about privacy. How 9 should we think about choice if, in fact, consumers say 10 I'm perfectly happy to have this kind of information 11 aligned together and I trust this retailer? Does that 12 make the privacy issues go away with respect to that 13 consumer, or should there be rules that go beyond that 14 if the consumer is willing to make such a choice? 15 Ari commented about that in terms of consumer 16 choice, but Cedric, the rules that you propose and the 17 like, and Rob, the comments that you made suggest that 18 we should at least be thinking about how much do we 19 weigh the choice that an individual consumer makes about 20 the information that's collected or potentially 21 collected about him or her. 22 MR. LAURANT: Yes, consent is very important to 23 consumers. They must know -- for their consent to be 24 taken as consent, they must be totally aware of what's
25 going on with the tagging, with what kind of information For The Record, Inc. Waldorf, Maryland (301) 870-8025 308
1 is being collected, processed later on, desimulated, 2 collated with other preexisting customer information. 3 What I can see now happening by reading the tags 4 that Marks & Spencer and Tesco and other companies 5 display to customers is that the statements are somehow 6 misleading. They do not explain clearly what's going 7 on. They do not explain clearly that the information 8 the customer will provide to the retailer, how that 9 information will be disseminated to other companies, 10 will be disclosed to other companies later on or might 11 be later on disclosed. 12 This is a very important part of most RFID 13 privacy policies that is generally not included in those 14 policies, is the fact that consumers should, if there is 15 an abuse, that their data is being disseminated contrary 16 to what the policy privacy establishes, they should have 17 access to court to have fair compensation, and that does 18 not exist under the current law, and I think the FTC 19 should very strictly sue the companies that have posted 20 a privacy policy if they do not comply with it. 21 Right now, what happens is the FTC has the 22 discretion to sue those companies, and the consumer does 23 not have access to the court if there is an abuse, a 24 privacy abuse.
25 MS. THORLEIFSON: Just one comment. The FTC For The Record, Inc. Waldorf, Maryland (301) 870-8025 309
1 has, in fact, sued companies who have posted privacy 2 policies and then not followed them. 3 MR. LAURANT: Yes, I haven't said that, but they 4 have the discretion to do so, and there is no 5 possibility when customers' privacy is being invaded to 6 actually sue the company, the infringing companies, 7 before a court. 8 MR. ATKINSON: I guess my take on that, Elliot, 9 is that a lot of the choice discussion ends up being 10 framed as if choice is costless, and if you thought 11 about choice from the environment -- let's say 12 ultimately we get to the Metro smart card solution where 13 you can stick your card through and it automatically 14 gets scanned, which I'd love to have, boy, that would be 15 great, you could really cut the cost of products and 16 speed checkout. 17 What if somebody says I don't like that, and I 18 deserve choice, so I deserve to actually have my stuff 19 read individually by somebody who's looking at it and 20 looking at the price. Okay, that's going to raise the 21 cost of checkout a significant amount, probably add a 22 dollar to checkout. Is the company going to be able to 23 charge for that? No way. Companies simply will not 24 charge for that, because it's the way the market works,
25 and yet, who will pay for that? Pretty much everybody For The Record, Inc. Waldorf, Maryland (301) 870-8025 310
1 else who doesn't really care. 2 So, I think we've got to really be careful with 3 choice. We have got to say, what are we actually giving 4 people choice of? And I think the choice should be, to 5 the extent feasible, do you remove the tag or not? 6 But the sort of choice about databases I think 7 is frankly a red herring. It's a problem in search of a 8 solution. We don't have choice today when I go to 9 Safeway and I use my credit card. If I don't want them 10 to know who I am, I just pay with cash. That's the 11 choice we make. You don't like it, pay with cash. 12 MR. MAXWELL: In the post-9/11 environment, one 13 of the observations that people have made is that 14 information in the hands of the private sector is no 15 longer so clearly distinguishable as information in the 16 public sector. The use of private sector information 17 for anti-terrorist activities and the like has tended to 18 collapse a distinction that we used to make very clearly 19 between information that private companies had and 20 information that the Government had access to, and I'm 21 wondering whether this kind of collapse of the 22 distinction would change any of the things we do about 23 information collection in general. 24 It's not specific to RFID, but it may change how
25 we think about the rules governing access to For The Record, Inc. Waldorf, Maryland (301) 870-8025 311
1 information. I'd be interested to see whether anyone 2 wanted to comment about that. 3 DR. JUELS: Well, I think that you're pointing 4 to a larger phenomenon here, Elliot, which is the fact 5 that the abuses of RFID may not necessarily be committed 6 by the original owners of the RFID tag. The retailer 7 who sells me the given item is not necessarily going to 8 be the malefactor who abuses my privacy, and there 9 should be concerns about abuse of RFID by local law 10 enforcement, for instance, particularly the abuses that 11 can take place covertly, and by retailers who may not 12 have privacy policies in place, to reiterate an earlier 13 point. 14 RFID is different than a loyalty card or a 15 credit card in that it's not a closed system. The RFID 16 tag can be scanned by somebody other than its original 17 owner, and it can be scanned at times when there's no 18 active volition on the part of the consumer. 19 MR. MAXWELL: But at the same time, I'm 20 concerned that legislation, precisely because RFID, its 21 technological facets make it such a slippery beast, that 22 legislation may not be effective in capturing all of 23 these nuances and really protecting consumer privacy. 24 Okay, I think this is going to be the last
25 question, and I would suggest a kind of theme that's For The Record, Inc. Waldorf, Maryland (301) 870-8025 312
1 gone throughout this, trying to figure out how RFID is 2 different if in any significant way from what 3 information consumers provide and retailers have had 4 access to in the past. Merchants have known the names, 5 addresses, items purchased, frequency of shopping, 6 amounts paid and lots of other stuff about their 7 customers since the 1800s and before. So, really, what 8 is new now, and what should we do differently now than 9 we do with respect to the information that they have had 10 access to and have had access to for quite some time? 11 MR. ATKINSON: Nothing. 12 MS. BRUENING: I'll take the other side of that. 13 Well, I think it's the power of the databases and it's 14 the computing power that allows the information to be 15 shared and collated and mined so efficiently, and I 16 think that's a lot of where -- your point about the 17 porosity of a wall between public and private sector 18 becomes so important, that because of that power and 19 those rich dossiers that we can potentially create, our 20 concerns about who has access to that become greater, 21 especially in the environment we're living in. 22 MR. STAFFORD: I think I would just sort of like 23 to bring it a little bit back to in the end, the RFID 24 deployment by retailers and manufacturers will be driven
25 by very sensible and very robust business cases to make For The Record, Inc. Waldorf, Maryland (301) 870-8025 313
1 the investment and to see a proper return on that 2 investment. It's very hard to think of any scenario 3 involving customer information that actually justifies 4 any of this sort of investment. 5 There is such an enormous opportunity to use 6 RFID to improve the efficiency and visibility of supply 7 chains and to actually provide better customer service, 8 but I don't think anybody really needs to go into these 9 contentious areas, because I don't see the business case 10 for it. 11 Now, of course, we should be aware about what 12 other people could do with what we're using by accident 13 or by design, but provided we keep thinking about the 14 possibilities going forward and we keep trying to steer 15 away from any negatives, then I think we've got a rosy 16 scenario for it. But be clear, there isn't a business 17 case about gathering customer information through RFID. 18 The business case, the fantastic business case, is all 19 about manufacturing efficiency and supply chain 20 efficiency, and that's the direction the industry will 21 take RFID in, I believe. 22 MR. MAXWELL: Let me then sort of make one sort 23 of comment before we wrap up. There clearly are a 24 couple of distinguishable issues. As people described
25 throughout the day, there's relatively little concern in For The Record, Inc. Waldorf, Maryland (301) 870-8025 314
1 the supply chain, per se, about the privacy issues. 2 There are issues in the retail store and in the retail 3 environment which look a lot like, although not exactly 4 like, the issues that we have with customer loyalty 5 cards and the retention of information that's already 6 collected. 7 There are a set of issues after sale which are 8 somewhat different and for which we have less 9 experience, and so it seems to me that one of the things 10 that we should be talking about is how do we look 11 carefully at the question of access to data, which goes 12 across both the in-store sale and post-sale data, and 13 secondly, about how we deal with the issues of access to 14 the information potentially available via the chip 15 post-sale, but those two places of focus are places 16 where, again, we can think about what can be done with a 17 technology, what can be done by industry practices, what 18 can be done by consumer education, and potentially, what 19 can be done by government action. 20 I think the FTC has been prescient in trying to 21 get people together to talk about these issues, to begin 22 this dialogue, which I hope will continue for quite some 23 time as we learn from each other. 24 I'd like to thank the panel very much for
25 coming, for your kind of incredible patience with the For The Record, Inc. Waldorf, Maryland (301) 870-8025 315
1 amount of information you've been given, and if anyone 2 would like to know what my purchases are at Giant and 3 Safeway, they can come up and see me after. 4 Thanks very much. 5 (Applause.) 6 MR. HARWOOD: I just want to mention as people 7 are headed out that you still have an opportunity to 8 comment on anything that's been said today or submit 9 additional comments. Comments are open until July 9th 10 on the FTC's Web site, which is ftc.gov/rfidworkshop. 11 We would love to hear from you if you have more thoughts 12 about what we've talked about today. 13 I would like to thank everybody who's come today 14 on behalf of Director Beales of the Federal Trade 15 Commission, particularly thank our panelists and 16 particularly thank Julie Brof for putting this on. 17 Thank you very much. 18 (Applause.) 19 (Whereupon, at 5:32 p.m., the workshop was 20 concluded.) 21 22 23 24
25 For The Record, Inc. Waldorf, Maryland (301) 870-8025 316
1 C E R T I F I C A T I O N O F R E P O R T E R 2 DOCKET/FILE NUMBER: P049106 3 CASE TITLE: RADIO FREQUENCY IDENTIFICATION WORKSHOP 4 DATE: JUNE 21, 2004 5 6 I HEREBY CERTIFY that the transcript contained 7 herein is a full and accurate transcript of the notes 8 taken by me at the hearing on the above cause before the 9 FEDERAL TRADE COMMISSION to the best of my knowledge and 10 belief. 11 12 DATED: 07/22/2004 13 14 15 16 SUSANNE BERGLING, RMR 17 18 C E R T I F I C A T I O N O F P R O O F R E A D E R 19 20 I HEREBY CERTIFY that I proofread the transcript 21 for accuracy in spelling, hyphenation, punctuation and 22 format. 23 24
25 DIANE QUADE For The Record, Inc. Waldorf, Maryland (301) 870-8025